CVE-2026-22005 – OAuth 2.0 Device Code Phishing (Short Interval)

Program Code (Python)

# device_code_server.py - Authorization server with too-fast polling
import time, secrets
codes = {}

@app.route('/device/code')
def device_code():
    code = secrets.token_urlsafe(16)
    codes[code] = {'user_code': secrets.token_hex(4), 'status': 'pending'}
    return jsonify(codes[code])

@app.route('/token')
def token():
    code = request.args['device_code']
    # Vulnerability: allows polling every 1 second, and attacker can brute-force user_code
    if codes[code]['status'] == 'pending':
        # Check if user_code was entered (simulated)
        time.sleep(0.5)  # delay to simulate user
        return jsonify({'access_token': 'secret'})

CVE-2026-22005 – OAuth 2.0 Device Code Phishing via Short Polling Interval

Overview

An OAuth 2.0 device authorization grant allows the client to poll the token endpoint every second. An attacker can initiate a device flow, display the user code to the victim (phishing), and because the polling interval is very short, the attacker receives the access token before the victim notices misuse.

Vulnerability Details

• Type: Social Engineering / Phishing
• Impact: Account takeover.
• Root Cause: The authorization server does not enforce a minimum polling interval (should be 5+ seconds) and does not require user verification code confirmation after token issuance.

Exploit Demonstration

Run the simulation:

pip install flask
python device_code_server.py
# Attacker starts flow, gets device_code and user_code, phishes victim.