Threats tagged 'brew-gyb-cve-2026-118669'

OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body, causing authorization checks to be performed under that other client's identity. This affects the client_credentials and password grant flows when the application validator uses the client_id argument for authorization. The flaw allows a low-privilege client to obtain tokens with broader scopes or grant types assigned to another client. The issue is fixed in OAuthlib version 1.97.