EUVD-2026-45427
GHSA-48hv-4375-2378
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered CSRF with no attacker privileges, but requires victim interaction (UI:R); only low integrity impact, no confidentiality or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in geex-arts django-jet up to 1.0.8. Affected is an unknown function of the component OAuth Handler. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Cross-site request forgery in the OAuth Handler component of geex-arts django-jet (versions up to 1.0.8) allows remote attackers to perform unauthorized actions on behalf of authenticated users. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms this is remotely exploitable with no privileges but requires a victim to interact with an attacker-controlled resource. A publicly available proof-of-concept exists (GitHub issue #528), and the vendor has not responded to the coordinated disclosure, meaning no patch is available at time of analysis.
Technical ContextAI
django-jet is a third-party Django admin interface enhancement library maintained by geex-arts, built on Python/Django. The affected component is the OAuth Handler, which manages OAuth authentication flows within the Django admin panel. CWE-352 (Cross-Site Request Forgery) describes the root cause: the OAuth Handler fails to validate that state-changing HTTP requests originate from the legitimate authenticated user rather than a forged cross-origin request. In OAuth flows, CSRF vulnerabilities are particularly impactful because they can allow an attacker to substitute their own OAuth authorization code or state token, potentially hijacking the OAuth binding between the victim's account and an OAuth provider. The CPE cpe:2.3:a:geex-arts:django-jet:*:*:*:*:*:*:*:* covers all versions through 1.0.8.
RemediationAI
No vendor-released patch is identified at time of analysis - the project maintainer has not responded to the disclosure. The most effective compensating control is to disable or remove the OAuth Handler component within django-jet if OAuth authentication is not strictly required, eliminating the attack surface entirely. If OAuth is required, restrict access to the Django admin panel to known trusted IP ranges via network-level controls (firewall, reverse proxy allow-list), which prevents unauthenticated network actors from delivering the forged request - note this does not protect against CSRF from a victim who is on an allowed network. Additionally, enforce Django's built-in CSRF middleware (django.middleware.csrf.CsrfViewMiddleware) and ensure it is not excluded for admin routes; if django-jet's OAuth Handler bypasses this middleware, patching the handler manually to include {% csrf_token %} validation or using @csrf_protect decorators is advisable. Monitor VulDB entry 380039 (https://vuldb.com/vuln/380039) and the GitHub repository for any upstream patch activity.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today