Bug 2563201 (CVE-2026-118669)

Summary: CVE-2026-118669 oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akhatavk, alinfoot, anpicker, anthomas, aos-team-art-private, aprice, asdas, bbrownin, brasmith, cahl, cochase, dfreiber, dkeler, doconnor, dpaolell, dranck, drow, dschmidt, dtrifiro, dymurray, ebourniv, eglynn, ehelms, gbenhaim, ggainey, gparvin, gtanzill, hasun, hoberger, ibolton, jbalunas, jburrell, jbuscemi, jdelft, jdobes, jfula, jjoyce, jlanda, jmatthew, jmitchel, jmontleo, jowilson, jpasqual, jsamir, jupierce, juwatts, jwong, kaycoth, kbempah, kgaikwad, kshier, lgarciaa, ljawale, lpele, mbiarnes, mburns, mdellweg, mgarciac, mhulan, mrunge, msilmser, mwoodson, niyer, nmoumoul, nyancey, oezr, omaciel, ometelka, orabin, osousa, pakotvan, pcreech, pgaikwad, ppalepu, ppostler, prdhamdh, prwatson, ptisnovs, rbobbitt, rchan, rekumar, rhaigner, rhel-process-autobot, rjohnson, sarad, sbunciak, sghai, sidsharm, simaishi, slucidi, smallamp, solenoci, sprizend, sseago, stcannon, sthirugn, suppawar, syedriko, thason, tmalecek, tsze, twaugh, vimartin, vkumar, vlaad, vvoronko, watson-tool-maintainers, weaton, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in oauthlib. In certain token grant flows, the authorization system can authenticate an incoming client while retaining a different, client-supplied identifier for permission and scope validation. A remote, authenticated attacker with lower privileges can exploit this inconsistency by submitting another client's identifier during token requests. This flaw leads to privilege escalation, potentially allowing the attacker to obtain access tokens with unauthorized permissions and scopes associated with another client.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-28 21:23:05 UTC 
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.client_id for validate_grant_type and validate_scopes. A lower-privilege authenticated client can therefore cause grant and scope authorization to use another client's identity when an application validator relies on the documented client_id argument, potentially issuing tokens with unauthorized grants or scopes. Validators that authorize exclusively from request.client may not be affected. This issue is fixed in version 4.0.0.