[Rania193]

Updates

• Affected versions: >= 3.3.0, < 4.0.0 → >= 3.3.0, <= 4.0.0
• Patched versions: 4.0.0 → none

Comments
The record lists 4.0.0 as patched, but the fix, 1c91d64 ("Merge pull request #954 from hekhuisk/improve-device-workflow", 2026-10-01), was merged after oauthlib 4.0.0 was published to PyPI on 2026-09-28. No release contains it yet; 4.0.0 is still the latest version on PyPI.

GitHub's compare API reports the v4.0.0 tag as diverged from 1c91d64 (3 commits behind it), so the fix is not in 4.0.0:

• oauthlib/oauthlib@v4.0.0...1c91d64

The upstream issue tracking this asks for a 4.0.1 or 4.1.0 release with the fix:

• CVE-2026-49272 is still considered unfixed, releasing minor/patch from master would solve this oauthlib/oauthlib#994

The repository advisory (GHSA-3jp2-3mrg-2vxc) also lists 4.0.0 as patched, which looks like the source of this value.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the oauthlib affected-range correction.

No open issues 🎉

What changed in this PR

Corrects the oauthlib advisory to mark version 4.0.0 as affected rather than patched, reflecting that the fix was merged after that release.

Changes:

• Replaces "fixed": "4.0.0" with "last_affected": "4.0.0".
• Includes 4.0.0 in the affected range and removes the listed patched version.

File	Description
advisories/​github-reviewed/​2026/​10/​GHSA-3jp2-3mrg-2vxc/​GHSA-3jp2-3mrg-2vxc.json	Corrects the affected-range endpoint for oauthlib 4.0.0.

_{Review effort: Balanced (auto)}

[paulsuh]

FYI - oauthlib released 4.0.1 with a fix on 2026-10-31.

[Alina-Podoba]

The fix is now released. oauthlib 4.0.1 (tag v4.0.1, commit 6e3aa05, 2026-10-31) contains oauthlib/oauthlib#954 (merge 77a5f1c). It adds DeviceCodeGrant.validate_device_code() and calls it from validate_token_request, and the 4.0.1 CHANGELOG names CVE-2026-49272 / GHSA-3jp2-3mrg-2vxc as fixed. v4.0.0 (145a9a4) still lacks any device_code check in oauthlib/oauth2/rfc8628/grant_types/device_code.py.

Suggested update: affected >= 3.3.0, < 4.0.1, patched 4.0.1 ("fixed": "4.0.1" instead of last_affected), and change the release reference from .../releases/tag/v4.0.0 to .../releases/tag/v4.0.1. The lower bound 3.3.0 is correct: DeviceCodeGrant was added in oauthlib/oauthlib#889 (028c563), first released in 3.3.0.

[paulsuh]

Base security advisory from the developer has been updated with info about 4.0.1. Please update this advisory. . GHSA-3jp2-3mrg-2vxc

[advisory-database]

Hi @Rania193! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!