CVE-2026-49272 | OAuthLib Device Code Grant device_code.py DeviceCodeGrant.validate_token_request device_code input validation

October 27, 2026 Yanac

A vulnerability was found in OAuthLib. It has been declared as critical. This issue affects the function DeviceCodeGrant.validate_token_request of the file oauthlib/oauth2/rfc6749/grant_types/device_code.py of the component Device Code Grant. The manipulation of the argument device_code results in improper input validation.

This vulnerability was named CVE-2026-49272. The attack may be performed from remote. There is no available exploit.VulDB Recent EntriesRead More