Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118669— OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

Quick assessment

Affected
oauthlib oauthlib
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OAuthLib 是 Python 3.6+ 的 OAuth 请求签名逻辑实现。在 4.0.0 版本之前，client_credentials 和 Resource Owner Password Credentials 令牌授予处理程序会将 request.client 认证为一个机密客户端（confidential client），同时保留由攻击者提供的 request.client_id，用于 validate_grant_type 和 validate_scopes 的验证。因此，当应用验证器依赖文档中定义的

CVSS 8.4 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118669

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client
Source: CVE Program / CVE List V5
Vulnerability Description
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.client_id for validate_grant_type and validate_scopes. A lower-privilege authenticated client can therefore cause grant and scope authorization to use another client's identity when an application validator relies on the documented client_id argument, potentially issuing tokens with unauthorized grants or scopes. Validators that authorize exclusively from request.client may not be affected. This issue is fixed in version 4.0.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
oauthlib oauthlib < 4.0.0 -

II. Public POCs for CVE-2026-118669

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118669

请登录查看更多情报信息。

Other References for CVE-2026-118669 (1)

Other References for CVE-2026-118669 (3)

IV. Related Vulnerabilities

Same product: oauthlib
Same vendor: oauthlib
Same weakness: CWE-863