Skip to content
OpenAdvisories
High RHSA-2026:98641 1 CVE

Red Hat Security Advisory: python-oauthlib security update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.3 python-oauthlib 0:3.2.2-6.el10_3.1
Red Hat · RHEL 10 enterprise_linux:10.3 python3-oauthlib 0:3.2.2-6.el10_3.1

Vulnerabilities 1

  • High 8.4
    CVE-2026-118669 Public exploit

    OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

    OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an…

    oauthlib oauthlib python-oauthlib oauthlib Debian Ubuntu Azure Linux PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2563201
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98641.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-118669
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-118669
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-118669
  • article
    https://github.com/oauthlib/oauthlib/commit/c951a1d09f99f14e3240973fa83c4f4287d4753d
  • article
    https://github.com/oauthlib/oauthlib/pull/920
  • article
    https://github.com/oauthlib/oauthlib/releases/tag/v4.0.0
  • article
    https://github.com/oauthlib/oauthlib/security/advisories/GHSA-7984-qgvg-3j9c