Threats tagged 'ghsa-7984-qgvg-3j9c'

OAuthlib versions prior to 4.0.0 contain a vulnerability in token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body. This causes grant type and scope validation to be performed under the attacker-supplied client_id rather than the authenticated client's identity. The flaw affects the client_credentials and resource owner password credentials grant flows. It allows a low-privilege client to obtain tokens with broader scopes or grant types assigned to another client. The issue is fixed in version 4.0.0.