Threats tagged 'brew-gcalcli-cve-2026-49272'

OAuthLib versions from 4.5.1_3 up to but not including 4.5.1_14 contain a vulnerability in the device workflow implementation of the OAuth 2.0 device authorization grant (RFC 8628). The token endpoint does not properly validate the device_code parameter, allowing an attacker who knows a valid client ID for a public client to obtain a bearer token without a valid device_code. This flaw arises because the DeviceCodeGrant.validate_token_request method lacks proper device_code validation and mishandles public clients. A fix is available in version 4.5.1_14.