oauthlib CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH oauthlib CVE published 2026-10-30

CVE-2026-118669

OAuthLib's token grant handlers can authenticate one client while authorizing the grant type and requested scopes using a different, attacker-supplied `client_id` from the request body. This issue affects OAuthlib provider deployments using the OAuth2 token endpoint handling for `client_credentials` and `password` / Resource Owner Password Credentials flows.