CVE-2026-118669 OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-118669?
CVE-2026-118669 is a high-severity vulnerability in oauthlib, published on 28 Oct 2026.
Official description
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.client_id for validate_grant_type and validate_scopes. A lower-privilege authenticated client can therefore cause grant and scope authorization to use another client's identity when an application validator relies on the documented client_id argument, potentially issuing tokens with unauthorized grants or scopes. Validators that authorize exclusively from request.client may not be affected. This issue is fixed in version 4.0.0.
Weakness: CWE-863
Which versions are affected by CVE-2026-118669?
How do I fix CVE-2026-118669?
No fix has been published for CVE-2026-118669 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-118669 being exploited?
There is no known exploitation of CVE-2026-118669 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-118669, GHSA-7984-qgvg-3j9c.