CVE-2026-16207

LOW

django-tastypie authentication.py ApiKeyAuthentication get request method with sensitive query strings

Title source: cna
STIX 2.1

Description

A vulnerability was detected in django-tastypie up to 0.15.1. Impacted is the function ApiKeyAuthentication of the file tastypie/authentication.py. The manipulation results in use of get request method with sensitive query strings. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The project was informed of the problem early through an issue report but has not responded yet.

References (6)

Core 6
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-380023 | django-tastypie authentication.py ApiKeyAuthentication get request method with sensitive query strings
https://vuldb.com/vuln/380023
Signature, Permissions Required signature permissions-required
VDB-380023 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/380023/cti
Third Party Advisory third-party-advisory
CVE-2026-16207 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-16207
Third Party Advisory third-party-advisory
Submit #857924 | django-tastypie 0.15.1 at commit 03c4746f0a0f88628be5264bc8d4a19a0529b2f4 CWE-598 Use of GET Request Method With Sensitive Query Strings
https://vuldb.com/submit/857924

Scores

CVSS v3 3.7
EPSS 0.0040
EPSS Percentile 32.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-598
Status published
Products (2)
None/django-tastypie 0.15.0
None/django-tastypie 0.15.1
Published Jul 19, 2026
Tracked Since Jul 19, 2026