songkick/oauth2-provider — Issue #17: Should validate client id/secret when validating access token?
Author: allenwei
Created: 2012-02-26 12:42:01+00:00
State: open

I'm not sure whether it is a security issue.
It do validate client id/secret in authentication, but there is not such validation in authorization.
so every client which get this access token can access protected resource.