Threats tagged 'ghsa-3jp2-3mrg-2vxc'

OAuthLib versions from 3.3.0 up to but not including 4.0.0 contain a vulnerability in the device code grant workflow (RFC 8628). The token endpoint does not properly validate the device_code parameter, allowing an attacker who knows a valid client ID for a public client configured for device workflow to obtain a bearer token without a valid device_code. This flaw arises because the DeviceCodeGrant.validate_token_request method lacks proper device_code validation. The issue is fixed in version 4.0.0.