Is CVE-2026-118669 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118669 being exploited in the wild.

How severe is CVE-2026-118669?

High severity, with a CVSS score of 4, published 28 October 2026.

Which products and versions are affected?

OAuthlib before 4.0.0; oauthlib (PyPI) < 4.0.0, ECOSYSTEM:introduced=0,fixed=4.0.0.

Is there a fix for CVE-2026-118669?

Yes. oauthlib (PyPI): upgrade to 4.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118669 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118669?

Check whether you run OAuthlib or oauthlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118669: OAuthLib client authentication bypass in token grants

Q: Is there a fix for CVE-2026-118669?

Yes. oauthlib (PyPI): upgrade to 4.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-118669 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-118669?

Check whether you run OAuthlib or oauthlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118669 · Severity: high · CVSS 4 · Published 2026-10-28

OAuthLib is a Python library that implements OAuth request signing for securing API access. In versions before 4.0.0, attackers with lower-privilege credentials could bypass authorization checks by mixing a legitimate authenticated client with an attacker-supplied client identifier. This allows issuing tokens with unauthorized permissions that should not have been granted to the attacker's client.

Technologies: OAuthlib, oauthlib (PyPI). Vendors: OAuthlib, PyPI.

Quick answers

Is CVE-2026-118669 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118669 being exploited in the wild.
How severe is CVE-2026-118669?: High severity, with a CVSS score of 4, published 28 October 2026.
Which products and versions are affected?: OAuthlib before 4.0.0; oauthlib (PyPI) < 4.0.0, ECOSYSTEM:introduced=0,fixed=4.0.0.
Is there a fix for CVE-2026-118669?: Yes. oauthlib (PyPI): upgrade to 4.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118669 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118669?: Check whether you run OAuthlib or oauthlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

oauthlib (PyPI): upgrade to 4.0.0 or later
```
pip install "oauthlib>=4.0.0"
```

Technical details

The vulnerability exists in client_credentials and Resource Owner Password Credentials token grant handlers, which could authenticate request.client as one confidential client while retaining an attacker-supplied request.client_id. Validators that rely on the documented client_id argument (rather than exclusively authorizing from request.client) are vulnerable. This is a logic flaw in token grant validation that can be exploited by an authenticated attacker to escalate privileges across different OAuth clients.

Affected products

OAuthLib OAuthLib before 4.0.0

Identifiers

CVE-2026-118669
GHSA-7984-qgvg-3j9c

Timeline

2026-10-28: disclosed
2026-07-11: patched: fix committed to repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.