CyberSecBulletin

Oauthlib vulnerabilities

We track 2 vulnerabilities in Oauthlib products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 5, 2026.

2vulnerabilities
0critical
2high
0exploited
8.4average CVSS score

Latest Oauthlib vulnerabilities

  • 8.5 High severity

    oauthlib: Improper Authentication

    CVE-2026-49272Oauthlib

    OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.3.0 until 4.0.1, OAuthLib's RFC 8628 device workflow does not require DeviceCodeGrant.validate_token_request to check that the device_code parameter is present and valid.

  • 8.4 High severity

    oauthlib: Incorrect Authorization

    CVE-2026-118669Oauthlib

    OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an