OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow

Summary A call to the token endpoint with a grant type of "urn:ietf:params:oauth:grant-type:devicecode" and a bogus devicecode is able to get a bearer token as long as they know a valid client ID enabled for the device workflow. Details Section 3.4 of the RFC 8628 spec says that the token endpoin...

PT-2026-127191

Summary A call to the token endpoint with a grant type of "urn:ietf:params:oauth:grant-type:device code" and a bogus device code is able to get a bearer token as long as they know a valid client ID enabled for the device workflow. Details Section 3.4 of the RFC 8628 spec says that the token...