Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🚨 Si tu servidor OAuth en Python usa oauthlib con el flujo device code, actualiza: CVE-2026-49272, severidad alta (CVSS 8.5). De la 3.3.0 a antes de la 4.0.0, el token endpoint no valida el device_code. Con solo un client ID válido, alguien obtiene un bearer token 👇 https://t.co/TkJblQV90j
🚨High - OAuthLib Device Flow Token Endpoint Auth Bypass (CVE-2026-49272) In OAuthLib's RFC 8628 device workflow, DeviceCodeGrant.validate_token_request fails to enforce validation of the device_code parameter. An attacker who knows a valid client_id for a device-enabled client can call the token endpoint with a missing/bogus device_code and still receive a bearer token, bypassing device-code verification. 👉Affected: RFC 8628 device workflow >=3.3.0 <4.0.0, Upgrade to 4.0.0 to mitigate