Security
- CVE-2026-49272 / GHSA-3jp2-3mrg-2vxc: The device code flow token endpoint did not validate the
device_codeparameter. A request with a knownclient_idand a bogusdevice_codecould obtain a bearer token.DeviceCodeGrant.validate_token_requestnow callsDeviceCodeGrant.validate_device_code(), which rejects missing or unknown device codes (invalid_request/invalid_grant) and delegates the code's authorization status to the newRequestValidator.validate_device_code()hook, per RFC 8628 Section 3.5. (cherry-picked from #954)
Upgrade note for device flow integrators
Custom RequestValidator implementations using the device flow must now implement validate_device_code(client_id, code, request). Return one of the DeviceCodeGrant.DEVICE_CODE_* statuses for known codes, or None for an unknown code. When returning AUTHORIZED, the validator must also populate request.user and request.scopes from the stored authorization.