HighVulnerabilityCVE-2026-49272updated 27 Oct 2026, 13:30 UTC

oauthlib device login accepts any device code, issuing tokens

A login step meant for devices like TVs or game consoles can be tricked into issuing access tokens without a valid code. This means someone could get into an account they should not be able to reach.

Fixed in oauthlib 4.0.0Official source

Severity	HighCVSS 8.5 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yesoauthlib 4.0.0 · since 27 Oct 2026
How sure is this?	Official sourceBacked by an official source

How the attack works simplified

1AttackerKnows a valid device-enabled client ID
2Token requestSends device grant with a bogus device_code
3Token endpointDoes not validate device_code
4Bearer tokenToken issued without authorization
ResultAttacker gets a valid access token

What happened

oauthlib's DeviceCodeGrant.validate_token_request never checks the device_code parameter, so a token endpoint using the RFC 8628 device grant issues bearer tokens for any value, given a valid client ID enabled for the device workflow.

Why it is dangerous: An attacker who knows a valid client ID can obtain a bearer token without authorizing a device, which can give access to protected data and actions of the users or services behind that client.

Are you affected?

You are affected if you use oauthlib 3.3.0 or later (before 4.0.0) to run an OAuth 2.0 token endpoint that supports the device_code grant type (RFC 8628).

Package / product	Affected versions	Fixed in
oauthlib · pip	>= 3.3.0, < 4.0.0	4.0.0

What to do

Upgrade oauthlib to version 4.0.0 or later (pip install --upgrade 'oauthlib>=4.0.0')
Check whether your token endpoint accepts the urn:ietf:params:oauth:grant-type:device_code grant type; if it does not, the risk does not apply
Review tokens issued through the device grant and revoke any you cannot account for

Timeline

27 Oct 2026, 13:30 UTC
Publicly disclosed
27 Oct 2026, 13:30 UTC
Reported by GitHub Advisory · GitHub Advisory
27 Oct 2026, 13:30 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflowGitHub Advisory · 27 Oct 2026, 13:30 UTC

Technical details

ID: CVE-2026-49272 · GHSA-3jp2-3mrg-2vxc
CVSS: 8.5 / 10
Disclosed: 27 Oct 2026, 13:30 UTC
On Zero Radar: 27 Oct 2026, 13:30 UTC (0 min after disclosure)
Last change: 27 Oct 2026, 13:30 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works