EUVD-2026-45417
GHSA-j4j7-8j5c-5hxw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable with low complexity; PR:L because a token is required; no availability impact from session expiration bypass.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in django-oauth django-oauth-toolkit 3.3.0. This issue affects the function _load_id_token of the file oauth2_provider/oauth2_validators.py. The manipulation leads to session expiration. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Insufficient session expiration in django-oauth-toolkit 3.3.0 allows authenticated network attackers to exploit the _load_id_token function in oauth2_provider/oauth2_validators.py, bypassing token expiration enforcement and maintaining access beyond their authorized session lifetime. The CVSS 4.0 score of 5.3 with PR:L confirms exploitation requires low-privilege access (a valid or expired token), and impacts confidentiality, integrity, and availability at a low level. No public exploit or active exploitation has been confirmed; the issue was submitted via a GitHub issue report and the project has not yet issued a response or patch.
Technical ContextAI
Django OAuth Toolkit is a Python library that adds OAuth2 provider capabilities to Django applications, implementing OpenID Connect (OIDC) flows including ID token issuance and validation. The affected function _load_id_token in oauth2_provider/oauth2_validators.py is responsible for loading and validating OIDC ID tokens during authentication or token introspection. CWE-613 (Insufficient Session Expiration) indicates the root cause is a failure to properly validate or enforce token expiration timestamps (the exp claim in JWT-based ID tokens), potentially allowing an expired ID token to be accepted as valid. The affected CPE is cpe:2.3:a:django-oauth:django-oauth-toolkit:*:*:*:*:*:*:*:*, with the reporter specifying version 3.3.0 as the confirmed vulnerable release. The * wildcard in the NVD CPE suggests the full affected version range has not yet been independently bounded.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project has not responded to the GitHub issue report at https://github.com/django-oauth/django-oauth-toolkit/issues/1715. As a compensating control, operators should enforce token expiration validation at the application or middleware layer independently of the library's _load_id_token function, for example by explicitly checking the exp JWT claim before accepting any ID token. Disabling or restricting OIDC ID token flows where not strictly necessary reduces attack surface. Implementing short token lifetimes (e.g., 5-15 minutes) at the authorization server level limits the exploitation window even when expiration is not enforced on the validation side. Organizations should monitor the upstream GitHub repository and VulDB entry at https://vuldb.com/cve/CVE-2026-16206 for patch availability. Side effect of middleware-level expiration checks: may break legitimate token refresh flows if refresh logic depends on the library's own expiration handling.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today