Improper Token Management in Django REST Framework by Encode

CVE-2026-114137

What is CVE-2026-114137?

The Django REST Framework versions 3.12.0 through 3.18.2 exhibit an improper token management vulnerability due to the incorrect handling of deletion operations in TokenProxy. Specifically, the delete() method in auth_token/models.py utilizes the user-id primary key rather than the token-string primary key. This design flaw enables a situation where revocations through a TokenProxy instance don't actually affect the corresponding token in the database, misleading applications into believing the credentials have been successfully revoked. Consequently, the token remains active, allowing continued authentication. This lapse poses significant security risks, especially for administrative integrations or operational scripts relying on the revocation of tokens. The issue is addressed in version 3.18.2, emphasizing the importance of timely upgrades to mitigate potential exploitation.

References