CVE-2026-118669

A flaw was found in oauthlib. In certain token grant flows, the authorization system can authenticate an incoming client while retaining a different, client-supplied identifier for permission and scope validation. A remote, authenticated attacker with lower privileges can exploit this inconsistency by submitting another client's identifier during token requests. This flaw leads to privilege escalation, potentially allowing the attacker to obtain access tokens with unauthorized permissions and scopes associated with another client.

This vulnerability is rated as an Important severity for Red Hat products because an authenticated client with low privileges can obtain access tokens under a different identity over the network, leading to significant privilege escalation without requiring user interaction. The exposure specifically impacts deployments where the server application relies on the submitted client identifier parameter during scope or grant checks instead of the authenticated client object. Workloads that do not act as an OAuth2 token endpoint or that enforce scope authorization solely from the authenticated entity remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.