OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.client_id for validate_grant_type and validate_scopes. A lower-privilege authenticated client can therefore cause grant and scope authorization to use another client's identity when an application validator relies on the documented client_id argument, potentially issuing tokens with unauthorized grants or scopes. Validators that authorize exclusively from request.client may not be affected. This issue is fixed in version 4.0.0.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…uthlib/security/advisories/GHSA-7984-qgvg-3j9c Diğer
• github.com/oauthlib/oauthlib/pull/920 Diğer
• github.com/…ommit/c951a1d09f99f14e3240973fa83c4f4287d4753d Diğer
• github.com/oauthlib/oauthlib/releases/tag/v4.0.0 Diğer

Kayıt geçmişi

1. 29 Eki 2026 00:09Yayımlandı

İlgili açıklar

• 8,6 CVE-2026-118668LangGraph JavaScript custom authentication may permit cross-user Store access
• 7,5 CVE-2026-118650Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
• 9,1 CVE-2026-118264Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
• 6,5 CVE-2026-118685ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard
• 7,1 CVE-2026-118676n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass
• 7,1 CVE-2026-118675n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow