OAuthLib: Bearer Token Can Be Retrieved As Long As Client Knows A Valid Client ID For Device Workflow

Summary A call to the token endpoint with a grant type of ""urn:ietf:params:oauth:grant-type:devicecode"" and a bogus "devicecode" is able to get a bearer token as long as they know a valid client ID enabled for the device workflow. Details "Section 3.4 of the RFC 8628 spec"...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via DeviceCodeGrant.validatetokenrequest, which performs no validation of the devicecode parameter. An attacker who knows a valid client ID configured for the device workflow can call t...