CVE-2026-118669: OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for validategranttype and validatescopes. A lower-privilege authenticated client can therefore cause grant and scope authorization to use another client's identity when an application validator relies on the documented clientid argument, potentially issuing tokens with unauthorized grants or scopes. Validators that authorize exclusively from request.client may not be affected. This issue is fixed in version 4.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OAuthLibto a version that resolves this vulnerability.Fixed in 4.0.0
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using OAuthLib before 4.0.0 are affected if they support the client_credentials or Resource Owner Password Credentials token grants and their application validator makes grant-type or scope authorization decisions using the client_id argument. Validators that authorize exclusively from request.client may not be affected.
What does an attacker need to exploit this issue?
The attacker needs credentials for a lower-privilege confidential client and must be able to submit an attacker-supplied client_id in a token-grant request. The handler can authenticate the lower-privilege client while passing the supplied identity to grant-type and scope validation.
What is the remediation if the validator relies on client_id?
Upgrade OAuthLib to version 4.0.0. If upgrading cannot happen immediately, ensure grant-type and scope authorization are based exclusively on the authenticated request.client rather than the client_id argument supplied to validator methods.