Session Hijack Vulnerability in DjangoCRM by Django

CVE-2026-71238

What is CVE-2026-71238?

DjangoCRM contains a severe configuration issue where the Django SECRET_KEY is hardcoded in the settings file instead of being sourced from an environment variable. This exposes the application to various exploits including session hijacking, where malicious actors can generate valid session cookies, CSRF tokens, and password reset tokens, potentially leading to unauthorized access to user accounts, including superadmin accounts. Additionally, the application's default DEBUG mode is enabled, which can expose sensitive error messages revealing key information such as database credentials, email credentials, OAuth details, and internal pathways. Proper security practices, such as securing sensitive information in environment variables and disabling DEBUG mode in production, are crucial to mitigating such vulnerabilities.

References