oauthlib device workflow skips device_code check, yielding bearer tokens

A Python sign-in helper can hand out access without the device check.

Summary

oauthlib's RFC 8628 device workflow does not validate the device_code parameter, so someone who knows a valid client ID for the device workflow can get a bearer token without completing device authorization. Versions from 3.3.0 until 4.0.1 are affected.

Affected when

RFC 8628 device workflow in use
a valid client ID enabled for the device workflow is known

What to do

Update to 4.0.1 or later. The sources give no stopgap.

Products and platforms

oauthlib

CVE IDs

CVE-2026-49272 (opens in a new tab)

Sources

Write-up: github.com (opens in a new tab)

Times

First published 2026-11-05 20:58 UTC

First seen 2026-11-09 17:20 UTC