CVE-2026-118669 oauthlib CVE debrief

Who should care

Defenders responsible for OAuthlib provider deployments, especially those using the affected token grant flows, should assess exposure and prioritize verification and updates. This includes reviewing client configurations, grant types, and monitoring for suspicious token grant requests. Additionally, defenders should consider the potential for privilege escalation and security issues in OAuthlib provider deployments, and take steps to verify and update

Why it matters

This vulnerability allows an attacker to use a different client_id for authorization after authenticating a different client, potentially leading to privilege escalation and security issues in OAuthlib provider deployments.

• An authenticated low-privilege confidential client can submit another client's `client_id` in the token request body and cause grant and scope validation to run under that other client identity
• Potential for privilege escalation in OAuthlib provider deployments
• Need for verification of client configurations and grant types
• Possible impact on client security and scope validation

Technical summary

OAuthLib's token grant handlers can authenticate one client while authorizing the grant type and requested scopes using a different, attacker-supplied `client_id` from the request body. In affected token grant flows, `authenticate_client(request)` sets `request.client` to the authenticated client object, but OAuthlib does not require `request.client_id` to match `request.client.client_id`. This issue allows an authenticated low-privilege confidential client to submit another client's `client_id` in the token request body, potentially leading to privilege escalation and security issues in OAuthlib provider deployments. The affected public surface is the OAuth2 token endpoint handling for `client_credentials` and

Defensive priority

Defenders should prioritize verifying and updating OAuthlib to version 4.0.0 or later, and assess exposure in their deployments, especially where lower-privilege confidential clients and clients with broader grants or scopes coexist.

Recommended defensive actions

• Verify OAuthlib version and update to 4.0.0 or later if necessary
• Assess exposure in OAuthlib provider deployments
• Review and adjust client configurations and grant types
• Monitor for suspicious token grant requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The issue is relevant to OAuthlib provider deployments where an attacker has credentials for one valid lower-privilege confidential client, another client has broader grants or scopes, and the application validator uses the `client_id`.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.