# CVE-2026-49272: OAuthLib device code grant missing validation

Source: https://junglewise.ai/threats/cve-2026-49272-oauthlib-bearer-token-can-be-retrieved-as-long-as-client-knows-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-49272 · Severity: high · CVSS 8.5 · Published 2026-11-05

OAuthLib is an OAuth 2.0 authentication library used by applications to implement login and credential delegation. The device workflow feature fails to validate device codes, allowing an attacker who knows a valid client ID to obtain a bearer token without providing a legitimate device code. This could allow unauthorized access to accounts or resources protected by the affected OAuth implementation.

Technologies: [OAuthlib](https://junglewise.ai/threats/technologies/oauthlib-oauthlib), [oauthlib (PyPI)](https://junglewise.ai/threats/technologies/oauthlib). Vendors: [OAuthlib](https://junglewise.ai/threats/vendors/oauthlib), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-49272 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49272 being exploited in the wild.

**How severe is CVE-2026-49272?** High severity, with a CVSS score of 8.5, published 5 November 2026.

**Which products and versions are affected?** OAuthlib <UNKNOWN>; oauthlib (PyPI) >= 3.3.0, < 4.0.0, ECOSYSTEM:introduced=3.3.0,fixed=4.0.0.

**Is there a fix for CVE-2026-49272?** Yes. oauthlib (PyPI): upgrade to 4.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49272 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-49272?** Check whether you run OAuthlib or oauthlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- oauthlib (PyPI): upgrade to 4.0.0 or later

  ```sh
  pip install "oauthlib>=4.0.0"
  ```


## Technical details

The DeviceCodeGrant.validate_token_request method does not validate the device_code parameter as required by RFC 8628 section 3.4, despite it being a mandatory field in the token endpoint request. An attacker can call the token endpoint with a valid client ID, the device_code grant type, and an arbitrary device_code value to receive a valid bearer token. The vulnerability affects implementations using the RFC 8628 device workflow where the client authentication is not properly enforced for public clients.

## Affected products

- OAuthLib OAuthLib <UNKNOWN>

## Identifiers

- CVE-2026-49272
- GHSA-3jp2-3mrg-2vxc

## Timeline

- 2026-10-27: disclosed

## Related threats

- [OAuthLib client authentication bypass in token grants](https://junglewise.ai/threats/cve-2026-118669-oauthlib-is-an-implementation-of-the-oauth-request-signing-logic)
- [OAuthlib timing attack in PKCE code_verifier comparison](https://junglewise.ai/threats/cve-2026-49265-oauthlib-timing-attack-vulnerability-in-pkce-code-verifier)
- [oauthlib unsafe JSONP callback injection in RevocationEndpoint](https://junglewise.ai/threats/cve-2026-49264-oauthlib-unsafe-jsonp-callback-injection-in-revocationendpoint)
- [oauthlib denial of service in URI validation with malicious IPv6](https://junglewise.ai/threats/cve-2022-36087-oauthlib-denial-of-service-in-uri-validation-with-malicious-ipv6)