CVE-2026-49272
Description
A flaw was found in OAuthLib. This vulnerability allows a remote attacker to bypass authentication and obtain unauthorized access tokens during the device authorization workflow. By submitting a token request with a valid client identifier alongside an invalid or missing device authorization code, the attacker can receive a valid bearer token without completing user approval, leading to unauthorized access to protected resources.
Statement
This vulnerability is rated as Important because a remote attacker with knowledge of a registered client identifier can bypass authentication mechanisms to acquire valid bearer tokens. Exploitation requires the authorization server to support and actively expose the RFC 8628 device authorization grant workflow. Deployments where the device authorization flow is not implemented or enabled are not susceptible to this flaw.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce presence and validation of the device_code parameter in DeviceCodeGrant.validate_token_request before issuing tokens: upgrade to OAuthLib 4.0.1 (or the fixed Rhoai/Odh Mlflow Rhel builds), which require device_code presence in DeviceCodeGrant.validate_token_request and delegate code verification and authorization state checks to RequestValidator.validate_device_code, closing all 2 injection vectors (token request with a bogus device_code parameter, token request with a missing device_code parameter). Until patched, this is only a concern on OAuthLib authorization servers implementing and exposing the RFC 8628 device authorization workflow — Deployments where the RFC 8628 device authorization flow is not implemented or enabled are unaffected — so disable the RFC 8628 device authorization grant workflow or restrict network access to the token endpoint and monitor token requests using client IDs registered for device authorization. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing device code validation flaw — apply the upstream patch to fully remediate.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.5 | N/A | 8.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
An incorrect implementation may allow authentication to be bypassed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
