Insufficient Session Expiration in Django-OAuth-Toolkit by Django
CVE-2026-16206

5.3MEDIUM

Key Information:

Vendor

Django-oauth

Status
Django-oauth-toolkit
Vendor
CVE Published:
19 July 2026

What is CVE-2026-16206?

A security flaw has been identified in django-oauth-toolkit version 3.3.0, specifically within the _load_id_token function located in the oauth2_provider/oauth2_validators.py file. This vulnerability allows for the potential manipulation of session expiration, which can be exploited remotely. Despite being reported through an issue tracking mechanism, the project maintainers have yet to address the problem.

Affected Version(s)

django-oauth-toolkit 3.3.0

References

https://vuldb.com/vuln/380022
vdb-entrytechnical-description
https://vuldb.com/vuln/380022/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-16206
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Galaxyn (VulDB User)
VulDB CNA Team
.