Summary
OAuthLib's device authorization workflow can issue a bearer token without verifying that a token request includes a valid device code. A client whose request is accepted by the configured validator and that knows a client ID enabled for the device workflow may be able to obtain a token without completing device authorization.
OAuthLib's device authorization workflow can issue a bearer token without verifying that a token request includes a valid device code. A client whose request is accepted by the configured validator and that knows a client ID enabled for the device workflow may be able to obtain a token without completing device authorization.
Affected context
The issue affects OAuthLib's RFC 8628 device workflow in versions from 3.3.0 up to, but not including, 4.0.1. It becomes relevant when the device-flow token endpoint accepts a client request through its configured validator but does not require DeviceCodeGrant.validate_token_request to verify that the device_code parameter is present and valid.
The issue affects OAuthLib's RFC 8628 device workflow in versions from 3.3.0 up to, but not including, 4.0.1. It becomes relevant when the device-flow token endpoint accepts a client request through its configured validator but does not require DeviceCodeGrant.validate_token_request to verify that the device_code parameter is present and valid.
Exploit preconditions
- Attack surface: The OAuth device-flow token endpoint
- Required access: A client request accepted by the configured validator and knowledge of a valid client ID enabled for the device workflow
- Trigger point: A token request that omits or supplies an invalid
device_code - Why exploitation is possible: The workflow does not ensure the device code is present and valid before issuing a bearer token
- Attack surface: The OAuth device-flow token endpoint
- Required access: A client request accepted by the configured validator and knowledge of a valid client ID enabled for the device workflow
- Trigger point: A token request that omits or supplies an invalid
device_code - Why exploitation is possible: The workflow does not ensure the device code is present and valid before issuing a bearer token
Why this happens
The device-flow token request validation does not enforce the required device-code check. This is an authentication bypass mapped to CWE-287: Improper Authentication: a token may be issued without verifying that the requester completed the device authorization associated with a valid code.
The device-flow token request validation does not enforce the required device-code check. This is an authentication bypass mapped to CWE-287: Improper Authentication: a token may be issued without verifying that the requester completed the device authorization associated with a valid code.
Potential impact
- An unauthorized client could obtain a bearer token without completing device authorization.
- A token holder could access resources permitted by the token's scope and privileges.
- Affected services could face unauthorized data access or actions performed under the token's authority.
- An unauthorized client could obtain a bearer token without completing device authorization.
- A token holder could access resources permitted by the token's scope and privileges.
- Affected services could face unauthorized data access or actions performed under the token's authority.
General mitigation guidance
Defensive patterns include requiring every device-flow token request to contain a valid, active device code and binding that code to the intended client and authorization state. Treat client identifiers as identifiers rather than proof of authorization, and apply consistent validation before issuing tokens. Limit token scopes and privileges, and ensure invalid or incomplete requests fail closed.
Defensive patterns include requiring every device-flow token request to contain a valid, active device code and binding that code to the intended client and authorization state. Treat client identifiers as identifiers rather than proof of authorization, and apply consistent validation before issuing tokens. Limit token scopes and privileges, and ensure invalid or incomplete requests fail closed.
How teams detect issues like this
- Review token-grant validation paths for device-code presence, validity, client binding, and authorization-state checks.
- Use static analysis or automated code review to flag token issuance paths that do not enforce grant-specific validation.
- Monitor for device-flow token requests with missing, malformed, or invalid device codes, especially when followed by successful token issuance.
- Enforce policy checks requiring grant-specific validation before any token is issued.
- Review token-grant validation paths for device-code presence, validity, client binding, and authorization-state checks.
- Use static analysis or automated code review to flag token issuance paths that do not enforce grant-specific validation.
- Monitor for device-flow token requests with missing, malformed, or invalid device codes, especially when followed by successful token issuance.
- Enforce policy checks requiring grant-specific validation before any token is issued.
