Read the docs
TI-2026-82213 Aliases CVE-2026-118669GHSA-7984-qgvg-3j9c

OAuthLib token grants can authorize with another client's identity

Priority HIGH 70CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 1 fixed, 21 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

OAuthLib before 4.0.0 is affected. The client_credentials and Resource Owner Password Credentials token grant handlers can authenticate one confidential client while still using an attacker-supplied client_id for grant and scope validation (CWE-863). A lower-privilege authenticated client can cause tokens with unauthorized grants or scopes to be issued when the application validator relies on client_id, while validators that authorize only from request.client may not be affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.client_id for validate_grant_type and validate_scopes. A lower-privilege authenticated client can therefore cause grant and scope authorization to use another client's identity when an application validator relies on the documented client_id argument, potentially issuing tokens with unauthorized grants or scopes. Validators that authorize exclusively from request.client may not be affected. This issue is fixed in version 4.0.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00312 24th percentileScored 2026-11-07
Fix Partial oauthlib (oauthlib): 4.0.0oauthlib (PyPI): 4.0.0Red Hat: 1 advisoryRed Hat: 1 fixed, 21 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
oauthliboauthlibbefore 4.0.04.0.0Patch availableCNA
—oauthlib (PyPI)before 4.0.04.0.0Patch availableGHSA-7984-qgvg-3j9c
  • oauthlib Vendoroauthlib Affected before 4.0.0 Fixed in 4.0.0 Patch available CNA
  • oauthlib (PyPI) Vendor— Affected before 4.0.0 Fixed in 4.0.0 Patch available GHSA-7984-qgvg-3j9c

Remediation

Upgrade oauthlib to version 4.0.0, which fixes the flaw on PyPI. Red Hat fixes it for Red Hat Discovery 2 in RHSA-2026:94802. The sources list no fixed version for Confidential Compute Attestation, Fence Agents Remediation Operator, Lightspeed Core, Lightspeed Services for Advanced Cluster Management and Migration Toolkit for Applications 8, and other products. Red Hat has no fix planned for Migration Toolkit for Containers.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA oauthlib (oauthlib) Fixed in 4.0.0
  • Fix · GHSA-7984-qgvg-3j9c oauthlib (PyPI) Fixed in 4.0.0 Advisory →

Red Hat 1 advisory

  • RHSA-2026:94802 Released 2026-11-04 · Red Hat rating Critical
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Confidential Compute AttestationAffectedNo fix yet
Fence Agents Remediation OperatorAffectedNo fix yet
Lightspeed CoreAffectedNo fix yet
Lightspeed Services for Advanced Cluster ManagementAffectedNo fix yet
Migration Toolkit for Applications 8AffectedNo fix yet
Migration Toolkit for ContainersAffectedNo fix planned: Will not fix
Migration Toolkit for VirtualizationAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
Red Hat AI Inference ServerAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat Lightspeed Services for OCPAffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat Discovery 2Fixed RHSA-2026:94802
Not affected: 7 products
  • OpenShift Service Mesh 3
  • Pen Drive Powered by Red Hat Lightspeed
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ansible Automation Platform 2
  • Red Hat Discovery 2
  • Red Hat OpenShift AI (RHOAI)
  • Service Telemetry Framework 1.5

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118669
  2. 2026-10-30 Priority changed: MEDIUM → LOW
  3. 2026-10-30 Affected versions changed · Red Hat
  4. 2026-10-30 CVSS score added · Red Hat
  5. 2026-10-30 Alias added: GHSA-7984-qgvg-3j9c
  6. 2026-10-30 Fix available: PyPI/[email protected] · GHSA-7984-qgvg-3j9c
  7. 2026-10-30 CVSS score added · GHSA-7984-qgvg-3j9c
  8. 2026-10-30 Weakness changed · GHSA-7984-qgvg-3j9c
  9. 2026-10-30 6 new references · GHSA-7984-qgvg-3j9c
  10. 2026-11-03 CISA SSVC decision points changed
  11. 2026-11-03 Priority changed: LOW → HIGH
  12. 2026-11-04 Affected versions changed · Red Hat
  13. 2026-11-04 Fix available: RHSA-2026:94802 · Red Hat
  14. 2026-11-04 Fix available: Red Hat Discovery 2 · Red Hat

References

Advisory 1

Other 5

  • TI-2026-85670 Missing device code check in OAuthLib lets callers get bearer tokens CVSS 3.1HIGH 8.5
  • TI-2026-71760 Unsafe JSONP callback injection in OAuthLib RevocationEndpoint CVSS 3.1MEDIUM 6.1
  • TI-2026-71761 Timing side channel in OAuthLib PKCE code_verifier comparison CVSS 3.1MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences