Threats tagged 'brew-ansible-cve-2026-118669'

OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body, causing authorization checks to be performed under that other client identity. This affects the client_credentials and password grant flows. The flaw allows the attacker to obtain tokens with scopes or grant types assigned to a higher-privilege client. The issue arises because OAuthlib does not require the authenticated client's client_id to match the client_id parameter used in grant and scope validation. A fix is available in version 14.4.0_1.