CVE-2026-118669: OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

OAuthlib’s token grant handlers can authenticate one client while authorizing the grant type and requested scopes using a different, attacker-supplied client_id from the request body.

In affected token grant flows, authenticate_client(request) sets request.client to the authenticated client object, but OAuthlib does not require request.client_id to match request.client.client_id. If the request body already contains client_id=..., OAuthlib keeps that value and passes it to validate_grant_type() and validate_scopes().

As a result, an authenticated low-privilege confidential client can authenticate as itself, submit another client’s client_id in the token request body, and cause grant and scope validation to run under that other client identity.