CVE-2026-49272: OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
(updated )
A call to the token endpoint with a grant type of "urn:ietf:params:oauth:grant-type:device_code" and a bogus device_code is able to get a bearer token as long as they know a valid client ID enabled for the device workflow.
References
- github.com/advisories/GHSA-3jp2-3mrg-2vxc
- github.com/oauthlib/oauthlib/commit/77a5f1c8ce00da2b0b8c5f6e9cc129920085f114
- github.com/oauthlib/oauthlib/pull/954
- github.com/oauthlib/oauthlib/releases/tag/v4.0.1
- github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc
- nvd.nist.gov/vuln/detail/CVE-2026-49272
Code Behaviors & Features
Detect and mitigate CVE-2026-49272 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →