Is there a public PoC exploit available for CVE-2026-16215?

Yes, a public proof-of-concept exploit is available for CVE-2026-16215. Prioritise patching immediately. EPSS: 0.3%.

django-jet CVE-2026-16215

Q: What is the CVSS score of CVE-2026-16215?

CVE-2026-16215 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-45426 MEDIUM

Missing Authorization (CWE-862)

2026-07-19 VulDB

GHSA-77jv-v8f5-wm86

Python Authentication Bypass Django Jet

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-accessible endpoint requires no privileges or interaction; scope unchanged with only low integrity and availability impact from unauthorized credential revocation and no confidentiality loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 19, 2026 - 05:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 19, 2026 - 05:20 vuln.today

CVE Published

Jul 19, 2026 - 04:30 cve.org

MEDIUM 6.9

DescriptionCVE.org

A security flaw has been discovered in geex-arts django-jet up to 1.0.8. This impacts an unknown function of the component OAuth Credential Revoke Handler. Performing a manipulation results in missing authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Missing authorization in the OAuth Credential Revoke Handler of geex-arts django-jet (versions up to 1.0.8) permits remote unauthenticated actors to revoke OAuth credentials without any access control check. The CVSS 4.0 vector (PR:N/UI:N) confirms no privileges or user interaction are required, and a public exploit exists (E:P). The project maintainer has not responded to the responsible disclosure, meaning no patch is available and no vendor advisory has been issued.

Technical ContextAI

django-jet is a third-party Django (Python) admin interface panel distributed by geex-arts that replaces and enhances the default Django admin UI. The affected component is its OAuth Credential Revoke Handler - an endpoint responsible for invalidating OAuth tokens issued to admin users or connected applications. CWE-862 (Missing Authorization) is the root cause class: the handler executes the revocation action without verifying whether the requesting party has the authority to revoke the target credential. The CPE string cpe:2.3:a:geex-arts:django-jet:*:*:*:*:*:*:*:* with an upper bound of 1.0.8 identifies all releases up to and including that version as affected.

RemediationAI

No vendor-released patch has been identified at time of analysis - the project maintainer has not responded to the disclosure per the reporter's account. As a compensating control, restrict network access to the OAuth credential revoke endpoint at the reverse proxy or WAF layer so that it is only reachable by authenticated, authorized sessions (this prevents unauthenticated network exploitation but requires knowledge of the specific route path). Alternatively, if OAuth is not actively used in your deployment, disable or remove the OAuth integration from django-jet's configuration to eliminate the attack surface entirely - note this will break any OAuth-dependent admin workflows. Organizations should evaluate migrating to an actively maintained Django admin alternative (e.g., django-unfold or the built-in admin) given the lack of maintainer response. Monitor the GitHub issue at https://github.com/geex-arts/django-jet/issues/528 for any future patch release.