Threats tagged 'brew-ansible@10-cve-2026-118669'

OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body, causing authorization checks to be performed under that other client identity. This affects the client_credentials and resource owner password credentials grant flows. The issue arises because OAuthlib does not require the client_id in the request body to match the authenticated client's client_id before validating grant types and scopes. As a result, a low-privilege client can obtain tokens with broader scopes or grant types assigned to another client if the application validator authorizes based on the attacker-supplied client_id argument.