oauthlib vulnerabilities (Root)

2 vulnerabilities.

• oauthlib Root OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client CVE-2026-118669 Fix available 8.4 HighOctober 28, 2026
• oauthlib Root OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow CVE-2026-49272 Fix available 8.5 HighOctober 27, 2026