CVE-2026-16206

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-16206

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16206.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-16206

Published

2026-07-19T02:15:08.796Z

Modified

2026-07-22T05:29:58.057999197Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator

Summary

django-oauth django-oauth-toolkit oauth2_validators.py _load_id_token session expiration

Details

A security vulnerability has been detected in django-oauth django-oauth-toolkit 3.3.0. This issue affects the function loadidtoken of the file oauth2provider/oauth2_validators.py. The manipulation leads to session expiration. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16206.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-613"
    ]
}

References

Affected packages

Git / github.com/django-oauth/django-oauth-toolkit

Affected ranges

Type

GIT

Repo

https://github.com/django-oauth/django-oauth-toolkit

Events

Introduced

1fbc0810fe0f1703f969c8f5d95f7545ed364d4d

Last affected

1fbc0810fe0f1703f969c8f5d95f7545ed364d4d

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "3.3.0"
        },
        {
            "last_affected": "3.3.0"
        }
    ]
}

Affected versions

3.*

3.3.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16206.json"