CVE-2026-16206

MEDIUM

django-oauth django-oauth-toolkit oauth2_validators.py _load_id_token session expiration

Title source: cna
STIX 2.1

Description

A security vulnerability has been detected in django-oauth django-oauth-toolkit 3.3.0. This issue affects the function _load_id_token of the file oauth2_provider/oauth2_validators.py. The manipulation leads to session expiration. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

References (7)

Core 7
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-380022 | django-oauth django-oauth-toolkit oauth2_validators.py _load_id_token session expiration
https://vuldb.com/vuln/380022
Signature, Permissions Required signature permissions-required
VDB-380022 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/380022/cti
Third Party Advisory third-party-advisory
CVE-2026-16206 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-16206
Third Party Advisory third-party-advisory
Submit #857897 | django-oauth django-oauth-toolkit 3.3.0 at commit ddec25b491e52d7f4a1e2cf13a436ffddcf6c782 CWE-613 Insufficient Session Expiration
https://vuldb.com/submit/857897
Third Party Advisory third-party-advisory
Submit #857923 | django-oauth django-oauth-toolkit 3.3.0 at commit ddec25b491e52d7f4a1e2cf13a436ffddcf6c782 CWE-613 Insufficient Session Expiration / CWE-287 Improper Authe (Duplicate)
https://vuldb.com/submit/857923

Scores

CVSS v3 6.3
EPSS 0.0021
EPSS Percentile 11.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-613
Status published
Products (1)
django-oauth/django-oauth-toolkit 3.3.0
Published Jul 19, 2026
Tracked Since Jul 19, 2026