OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

Summary OAuthlib's token grant handlers can authenticate one client while authorizing the grant type and requested scopes using a different, attacker-supplied clientid from the request body. In affected token grant flows, authenticateclient(request) sets request.client to the authenticated client object, but OAuthlib does not require request.clientid to match request.client.clientid. If the request body already contains clientid=..., OAuthlib keeps that value and passes it to validategranttype() and validatescopes(). As a result, an authenticated low-privilege confidential client can authenticate as itself, submit another client's clientid in the token request body, and cause grant and scope validation to run under that other client identity. Affected Surface The affected public surface is the OAuth2 token endpoint handling for: clientcredentials password / Resource Owner Password Credentials The issue is relevant to OAuthlib provider deployments where: the attacker has credentials for one valid lower-privilege confidential client; another client has broader grants or scopes; the application validator uses the clientid argument passed by OAuthlib in validategranttype() or…

curl https://cve.zerocrew.in/api/cve/CVE-2026-118669