Django Oauth Toolkit
Monthly
Insufficient session expiration in django-oauth-toolkit 3.3.0 allows authenticated network attackers to exploit the `_load_id_token` function in `oauth2_provider/oauth2_validators.py`, bypassing token expiration enforcement and maintaining access beyond their authorized session lifetime. The CVSS 4.0 score of 5.3 with PR:L confirms exploitation requires low-privilege access (a valid or expired token), and impacts confidentiality, integrity, and availability at a low level. No public exploit or active exploitation has been confirmed; the issue was submitted via a GitHub issue report and the project has not yet issued a response or patch.
Insufficient session expiration in django-oauth-toolkit 3.3.0 allows authenticated network attackers to exploit the `_load_id_token` function in `oauth2_provider/oauth2_validators.py`, bypassing token expiration enforcement and maintaining access beyond their authorized session lifetime. The CVSS 4.0 score of 5.3 with PR:L confirms exploitation requires low-privilege access (a valid or expired token), and impacts confidentiality, integrity, and availability at a low level. No public exploit or active exploitation has been confirmed; the issue was submitted via a GitHub issue report and the project has not yet issued a response or patch.