CVE-2026-49272

A call to the token endpoint with a grant type of "urn:ietf:params:oauth:grant-type:device code" and a bogus device code is able to get a bearer token as long as they know a valid client ID enabled for the device workflow.

Section 3.4 of the RFC 8628 spec says that the token endpoint should take in device code as a required parameter.DeviceCodeGrant.validate token request does not perform any validation of device code. DeviceCodeGrant.validate token request should be validating that device code was passed in as a parameter and that it is valid, similar to how AuthorizationCodeGrant.validate token request does the checks [here](https://github.com/oauthlib/oauthlib/blob/a015b446622f2b925517501fe484c10eff7a83c0/oauthlib/oauth2/rfc6749/grant types/authorization code.py#L446) and [here](https://github.com/oauthlib/oauthlib/blob/a015b446622f2b925517501fe484c10eff7a83c0/oauthlib/oauth2/rfc6749/grant types/authorization code.py#L483).

I would like to propose a new method be added to RequestValidator called validate device code that is similar to the validate code method and is called inside of DeviceCodeGrant.validate token request.

Create an implementation of RequestValidation.authenticate client that returns True if the client's client type is "public". You would find yourself in this scenario because there's another issue with DeviceCodeGrant.validate token request where it doesn't properly handle public clients (see https://github.com/oauthlib/oauthlib/issues/919).

Create a client that has a client type of "public" and set it's grant type to "urn:ietf:params:oauth:grant-type:device code".

With this implementation of RequestValidation.authenticate client done, use that validator for your token endpoint. Call the token endpoint with a body of

{
 "client id": <ID of the public client you made>,
 "grant type": "urn:ietf:params:oauth:grant-type:device code",
 "device code": <anything you want since it's not validated>
}

You now have a bearer token for the client without a valid device code.

Anyone using the RFC 8628 device workflow in oauthlib that doesn't realize the device code parameter is not being validated.