OAuthLib CVE-2026-118669 (GHSA-7984-qgvg-3j9c): token endpoint authenticates one client but checks grant type and scopes against an attacker-supplied client_id (client_credentials / password grants). Am I affected and how do I upgrade to 4.0.0 safely?

What it is: A high-severity advisory published 2026-10-30 for OAuthLib, the Python library behind many OAuth 2.0 providers (including django-oauth-toolkit and Flask-based servers). In the client_credentials and password (Resource Owner Password Credentials) grants, OAuthLib authenticated the client but kept any client_id sent in the request body, and passed that value to validate_grant_type() and validate_scopes(). A low-privilege confidential client could authenticate as itself while naming a more privileged client, and have grant and scope checks run as that other client, potentially getting a token with broader scopes. Am I affected: - OAuthLib below 4.0.0 used as an OAuth 2.0 provider (server side), and - your RequestValidator's validate_grant_type() or validate_scopes() decides based on the client_id argument rather than request.client, and - you have several confidential clients with different allowed grants or scopes. - Check: pip show oauthlib, and look at your validator code (or your framework's, such as django-oauth-toolkit) for how it uses client_id. Fix: 1. Upgrade to OAuthLib 4.0.0 or later (pip install -U "oauthlib>=4.0.0", update lockfiles). 4.0.0 is a major release with breaking changes: JSONP support was removed from the token revocation endpoint, and client authentication validation was reorganized so grant_type is checked before client authentication. Run your OAuth tests and check that frameworks built on OAuthLib support 4.0.0. 2. Until you can upgrade, make your validator use request.client (the authenticated client) for grant and scope decisions, or reject token requests where the body's client_id doesn't match the authenticated client. 3. Review token issuance logs for client_credentials or password grants where the authenticated client differs from the body's client_id, and revoke any tokens issued that way. Verify: pip show oauthlib reports 4.0.0+, and a test token request authenticated as client A with client_id=B in the body is rejected or limited to A's scopes. Sources: https://github.com/oauthlib/oauthlib/security/advisories/GHSA-7984-qgvg-3j9c https://github.com/oauthlib/oauthlib/releases/tag/v4.0.0 https://nvd.nist.gov/vuln/detail/CVE-2026-118669