Threats affecting pkg:brew/evernote-backup

OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body. This causes grant and scope validation to be performed under the attacker-supplied client_id rather than the authenticated client. The issue affects the client_credentials and resource owner password credentials grant flows. An attacker with valid credentials for one client can obtain tokens with scopes or grant types assigned to another client, effectively bypassing token authorization restrictions.