OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.client_id for validate_grant_type and validate_scopes. A lower-privilege authenticated client can therefore cause grant and scope authorization to use another client's identity when an application validator relies on the documented client_id argument, potentially issuing tokens with unauthorized grants or scopes. Validators that authorize exclusively from request.client may not be affected. This issue is fixed in version 4.0.0.

[ Fixes ]Fixes and patches

• oauthlib 4.0.0Fixed version · GitHub Advisories · pip package oauthlib: upgrade to 4.0.0 or later (affected < 4.0.0)

[ Packages ]Affected open-source packages

• oauthlib pipAffected < 4.0.0 · fixed in 4.0.0 · GHSA-7984-qgvg-3j9c

[ References ]References

• github.com/oauthlib/oauthlib/commit/c951a1d09f99f14e3240973fa83c4f4287d4753d
• github.com/oauthlib/oauthlib/pull/920
• github.com/oauthlib/oauthlib/releases/tag/v4.0.0
• github.com/oauthlib/oauthlib/security/advisories/GHSA-7984-qgvg-3j9c