EUVD-2026-112488

OAuthLib: Token grants can use attacker-supplied clientid for authorization after authenticating a different client...

CVE-2026-118669

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for...

CVE-2026-118669

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for...

UBUNTU-CVE-2026-118669

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for...

Linux Distros Unpatched Vulnerability : CVE-2026-118669

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials...

SUSE CVE-2026-118669

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for...

AZL-112133 CVE-2026-118669 affecting package python-oauthlib 3.2.2-4

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for...

DEBIAN-CVE-2026-118669

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for...

CVE-2026-118669

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for...

CVE-2026-118669

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for...

CVE-2026-118669

OAuthLib , a Python 3.6+ OAuth request-signing implementation, is vulnerable to an authorization bypass in versions prior to 4.0.0 . The client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while incorrectly ret...

CVE-2026-118669 OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for...

CVE-2026-118669 OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for...

OAuthLib authorization issue vulnerability

Versions of OAuthLib prior to 4.0.0 contain an authorization issue vulnerability. This vulnerability arises because the token authorization handlers for clientcredentials and Resource Owner Password Credentials retain the clientid provided by attackers during validation of authorization types and...

CVE-2026-118669: oauthlib: OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for...

PT-2026-129190

Name of the Vulnerable Software and Affected Versions OAuthLib versions prior to 4.0.0 Description In the client credentials and Resource Owner Password Credentials token grant handlers, the system can authenticate request.client as one confidential client while retaining an attacker-supplied...

Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts

Cybersecurity researchers have warned of a "massive, ongoing, automated password spray attack" aimed at Microsoft's Azure command-line interface CLI, compromising dozens of accounts in the process. The activity, per Huntress, originates from an IPv6 address range 2a0a:d683::/32 controlled by...

CVE-2026-56350

n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforcement through the API. Attackers can create local password credentials to authenticate directly, bypassing organizational SSO policies and identity-provider-enforced multi-factor...

keycloak: Keycloak: Security restriction bypass allows unauthorized ROPC token acquisition

A flaw was found in Keycloak's Client Policies, specifically within the org.keycloak.protocol.oidc component. When certain condition providers client-type, client-roles, client-attributes, client-scopes are used to enforce security restrictions, the reject-ropc-grant executor is silently bypassed...

CVE-2026-9792

A flaw was found in Keycloak's Client Policies, specifically within the org.keycloak.protocol.oidc component. When certain condition providers client-type, client-roles, client-attributes, client-scopes are used to enforce security restrictions, the reject-ropc-grant executor is silently bypassed...