# CVE-2026-118669: OAuthLib client authentication bypass in token grants

Source: https://junglewise.ai/threats/cve-2026-118669-oauthlib-is-an-implementation-of-the-oauth-request-signing-logic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-118669 · Severity: high · CVSS 4 · Published 2026-10-28

OAuthLib is a Python library that implements OAuth request signing for securing API access. In versions before 4.0.0, attackers with lower-privilege credentials could bypass authorization checks by mixing a legitimate authenticated client with an attacker-supplied client identifier. This allows issuing tokens with unauthorized permissions that should not have been granted to the attacker's client.

Technologies: [OAuthlib](https://junglewise.ai/threats/technologies/oauthlib-oauthlib), [oauthlib (PyPI)](https://junglewise.ai/threats/technologies/oauthlib). Vendors: [OAuthlib](https://junglewise.ai/threats/vendors/oauthlib), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-118669 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118669 being exploited in the wild.

**How severe is CVE-2026-118669?** High severity, with a CVSS score of 4, published 28 October 2026.

**Which products and versions are affected?** OAuthlib before 4.0.0; oauthlib (PyPI) < 4.0.0, ECOSYSTEM:introduced=0,fixed=4.0.0.

**Is there a fix for CVE-2026-118669?** Yes. oauthlib (PyPI): upgrade to 4.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118669 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118669?** Check whether you run OAuthlib or oauthlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- oauthlib (PyPI): upgrade to 4.0.0 or later

  ```sh
  pip install "oauthlib>=4.0.0"
  ```


## Technical details

The vulnerability exists in client_credentials and Resource Owner Password Credentials token grant handlers, which could authenticate request.client as one confidential client while retaining an attacker-supplied request.client_id. Validators that rely on the documented client_id argument (rather than exclusively authorizing from request.client) are vulnerable. This is a logic flaw in token grant validation that can be exploited by an authenticated attacker to escalate privileges across different OAuth clients.

## Affected products

- OAuthLib OAuthLib before 4.0.0

## Identifiers

- CVE-2026-118669
- GHSA-7984-qgvg-3j9c

## Timeline

- 2026-10-28: disclosed
- 2026-07-11: patched: fix committed to repository

## References

- [https://github.com/oauthlib/oauthlib/commit/c951a1d09f99f14e3240973fa83c4f4287d4753d](https://github.com/oauthlib/oauthlib/commit/c951a1d09f99f14e3240973fa83c4f4287d4753d)
- [https://github.com/oauthlib/oauthlib/pull/920](https://github.com/oauthlib/oauthlib/pull/920)

## Related threats

- [OAuthLib device code grant missing validation](https://junglewise.ai/threats/cve-2026-49272-oauthlib-bearer-token-can-be-retrieved-as-long-as-client-knows-a)
- [OAuthlib timing attack in PKCE code_verifier comparison](https://junglewise.ai/threats/cve-2026-49265-oauthlib-timing-attack-vulnerability-in-pkce-code-verifier)
- [oauthlib unsafe JSONP callback injection in RevocationEndpoint](https://junglewise.ai/threats/cve-2026-49264-oauthlib-unsafe-jsonp-callback-injection-in-revocationendpoint)
- [oauthlib denial of service in URI validation with malicious IPv6](https://junglewise.ai/threats/cve-2022-36087-oauthlib-denial-of-service-in-uri-validation-with-malicious-ipv6)