CVE-2026-49272

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49272", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-28T20:07:58.860Z", "datePublished": "2026-11-05T20:58:00.517Z", "dateUpdated": "2026-11-05T21:14:43.982Z"}, "containers": {"cna": {"title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc"}, {"name": "https://github.com/oauthlib/oauthlib/pull/954", "tags": ["x_refsource_MISC"], "url": "https://github.com/oauthlib/oauthlib/pull/954"}, {"name": "https://github.com/oauthlib/oauthlib/commit/77a5f1c8ce00da2b0b8c5f6e9cc129920085f114", "tags": ["x_refsource_MISC"], "url": "https://github.com/oauthlib/oauthlib/commit/77a5f1c8ce00da2b0b8c5f6e9cc129920085f114"}, {"name": "https://github.com/oauthlib/oauthlib/releases/tag/v4.0.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/oauthlib/oauthlib/releases/tag/v4.0.1"}], "affected": [{"vendor": "oauthlib", "product": "oauthlib", "versions": [{"version": ">= 3.3.0, < 4.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T20:58:00.517Z"}, "descriptions": [{"lang": "en", "value": "OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.3.0 until 4.0.1, OAuthLib's RFC 8628 device workflow does not require DeviceCodeGrant.validate_token_request to check that the device_code parameter is present and valid. A caller whose client request is accepted by the configured validator and who knows a valid client ID enabled for the device workflow can submit a missing or bogus device code to the token endpoint and obtain a bearer token without completing device authorization. This issue is fixed in version 4.0.1."}], "source": {"advisory": "GHSA-3jp2-3mrg-2vxc", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T21:14:28.774870Z", "id": "CVE-2026-49272", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:14:43.982Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49272", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:14:28.774870Z"}}}], "references": [{"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:14:39.850Z"}}], "cna": {"title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow", "source": {"advisory": "GHSA-3jp2-3mrg-2vxc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "oauthlib", "product": "oauthlib", "versions": [{"status": "affected", "version": ">= 3.3.0, < 4.0.1"}]}], "references": [{"url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc", "name": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/oauthlib/oauthlib/pull/954", "name": "https://github.com/oauthlib/oauthlib/pull/954", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/oauthlib/oauthlib/commit/77a5f1c8ce00da2b0b8c5f6e9cc129920085f114", "name": "https://github.com/oauthlib/oauthlib/commit/77a5f1c8ce00da2b0b8c5f6e9cc129920085f114", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/oauthlib/oauthlib/releases/tag/v4.0.1", "name": "https://github.com/oauthlib/oauthlib/releases/tag/v4.0.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.3.0 until 4.0.1, OAuthLib's RFC 8628 device workflow does not require DeviceCodeGrant.validate_token_request to check that the device_code parameter is present and valid. A caller whose client request is accepted by the configured validator and who knows a valid client ID enabled for the device workflow can submit a missing or bogus device code to the token endpoint and obtain a bearer token without completing device authorization. This issue is fixed in version 4.0.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T20:58:00.517Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49272", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:14:43.982Z", "dateReserved": "2026-05-28T20:07:58.860Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-05T20:58:00.517Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "oauthlib", "vendor": "oauthlib", "versions": [{"status": "affected", "version": ">= 3.3.0, < 4.0.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.3.0 until 4.0.1, OAuthLib's RFC 8628 device workflow does not require DeviceCodeGrant.validate_token_request to check that the device_code parameter is present and valid. A caller whose client request is accepted by the configured validator and who knows a valid client ID enabled for the device workflow can submit a missing or bogus device code to the token endpoint and obtain a bearer token without completing device authorization. This issue is fixed in version 4.0.1."}], "id": "CVE-2026-49272", "lastModified": "2026-11-12T20:04:52.377", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49272", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:14:28.774870Z", "version": "2.0.3"}}]}, "published": "2026-11-05T21:18:50.447", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/oauthlib/oauthlib/commit/77a5f1c8ce00da2b0b8c5f6e9cc129920085f114"}, {"source": "security-advisories@github.com", "url": "https://github.com/oauthlib/oauthlib/pull/954"}, {"source": "security-advisories@github.com", "url": "https://github.com/oauthlib/oauthlib/releases/tag/v4.0.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "oauthlib: oauthlib: Authentication bypass via missing device code validation", "id": "2567703", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567703"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N", "status": "draft"}, "cwe": "CWE-303", "details": ["A flaw was found in OAuthLib. This vulnerability allows a remote attacker to bypass authentication and obtain unauthorized access tokens during the device authorization workflow. By submitting a token request with a valid client identifier alongside an invalid or missing device authorization code, the attacker can receive a valid bearer token without completing user approval, leading to unauthorized access to protected resources."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-49272", "package_state": [{"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-mlflow-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-11-05T20:58:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-49272\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-49272\nhttps://github.com/oauthlib/oauthlib/commit/77a5f1c8ce00da2b0b8c5f6e9cc129920085f114\nhttps://github.com/oauthlib/oauthlib/pull/954\nhttps://github.com/oauthlib/oauthlib/releases/tag/v4.0.1\nhttps://github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc"], "statement": "This vulnerability is rated as Important because a remote attacker with knowledge of a registered client identifier can bypass authentication mechanisms to acquire valid bearer tokens. Exploitation requires the authorization server to support and actively expose the RFC 8628 device authorization grant workflow. Deployments where the device authorization flow is not implemented or enabled are not susceptible to this flaw.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.3.0,4.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "oauthlib", "source": "cna", "vendor": "oauthlib"}, "product": "oauthlib", "vendor": "oauthlib"}], "created": "2026-11-05T22:30:17.932157+00:00", "updated": "2026-11-06T15:00:07.994394+00:00", "vendors": ["oauthlib", "oauthlib$PRODUCT$oauthlib"]}