VDB
CVE-2026-16206
CVE-2026-16206
PUBLISHED
CVSS 5.3 MEDIUM
Reported by VulDB · Published July 19, 2026
A security vulnerability has been detected in django-oauth django-oauth-toolkit 3.3.0. This issue affects the function _load_id_token of the file oauth2_provider/oauth2_validators.py. The manipulation leads to session expiration. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.
Risk Scores
CVSS 4.0
5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| django-oauth | django-oauth-toolkit | 3.3.0 |
| django-oauth | django-oauth-toolkit | 3.3.0 |
Timeline
- Jul 19, 2026 CVE Published
- Jul 20, 2026 CVE Updated
- Aug 7, 2026 EPSS Score
- Aug 24, 2026 EPSS Score
- Aug 26, 2026 EPSS Score
- Aug 30, 2026 EPSS Score
- Sep 3, 2026 EPSS Score
- Sep 6, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
References
- VDB-380022 | django-oauth django-oauth-toolkit oauth2_validators.py _load_id_token session expiration vdb-entrytechnical-description
- VDB-380022 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
- CVE-2026-16206 | CVE Analysis and Report third-party-advisory
- Submit #857897 | django-oauth django-oauth-toolkit 3.3.0 at commit ddec25b491e52d7f4a1e2cf13a436ffddcf6c782 CWE-613 Insufficient Session Expiration third-party-advisory
- Submit #857923 | django-oauth django-oauth-toolkit 3.3.0 at commit ddec25b491e52d7f4a1e2cf13a436ffddcf6c782 CWE-613 Insufficient Session Expiration / CWE-287 Improper Authe (Duplicate) third-party-advisory
- issue-tracking
- product