Zero Radar
← feed
HighVulnerabilityCVE-2026-118669updated 30 Oct 2026, 22:58 UTC

OAuthlib lets one client get grants meant for another

A client app with limited permissions can sometimes pretend to be a more powerful app during token requests. This can let it obtain access it should not have.

Fixed in 4.0.0 · out Official, 2 sources
SeverityHighCVSS 8.4 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes4.0.0 · since 30 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Low-privilege clientHas valid credentials for one client
  2. 2Token requestAdds another client_id in the request body
  3. 3OAuthlib authenticatesChecks the real client, but keeps the body client_id
  4. 4Wrong identity checkedGrant and scope checks use the other client
  5. 5Token issuedContains grants or scopes not allowed for the attacker
  6. ResultAttacker gets unauthorized access tokens

What happened

In OAuthlib's client_credentials and password grant handlers, the authenticated client and the client_id used for grant and scope validation can differ, because an attacker-supplied client_id in the request body is kept. This affects validators that rely on the client_id argument.

Why it is dangerous: A lower-privilege authenticated client can cause tokens with unauthorized grants or scopes to be issued, which may expose data or actions reserved for other clients.

Are you affected?

You are affected if you run an OAuthlib-based OAuth2 provider before 4.0.0 with client_credentials or password grants, and your validator authorizes using the client_id argument rather than only request.client.

Package / productAffected versionsFixed in
oauthlib · pip< 4.0.04.0.0

What to do

  1. Update oauthlib to version 4.0.0 or later
  2. Review validate_grant_type and validate_scopes to confirm they authorize from request.client, not the client_id argument
  3. Check token logs for grants or scopes issued to clients that should not have them

Timeline

  1. 28 Oct 2026, 22:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 22:17 UTC
    Reported by NVD · NVD
  3. 28 Oct 2026, 22:18 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 22:58 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 30 Oct 2026, 22:58 UTC
    Fixed version published: oauthlib 4.0.0 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118669 · GHSA-7984-qgvg-3j9c
CVSS
8.4 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
28 Oct 2026, 22:17 UTC
On Zero Radar
28 Oct 2026, 22:18 UTC (2 min after disclosure)
Last change
30 Oct 2026, 22:58 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

OAuthlib lets one client get grants meant for another · Zero Radar