Vulnerability · Published Jul 19, 2026 · Assigned by VulDB
CVE-2026-16206django-oauth django-oauth-toolkit oauth2_validators.py _load_id_token session expiration
Medium 6.3
In plain English
A medium-severity security flaw in django-oauth-toolkit from django-oauth. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Official description
A security vulnerability has been detected in django-oauth django-oauth-toolkit 3.3.0. This issue affects the function _load_id_token of the file oauth2_provider/oauth2_validators.py. The manipulation leads to session expiration. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| django-oauth | django-oauth-toolkit | 3.3.0 |
Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R
References
- VDB-380022 | django-oauth django-oauth-toolkit oauth2_validators.py _load_id_token session expiration vdb-entry, technical-description
- VDB-380022 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-16206 | CVE Analysis and Report third-party-advisory
- Submit #857897 | django-oauth django-oauth-toolkit 3.3.0 at commit ddec25b491e52d7f4a1e2cf13a436ffddcf6c782 CWE-613 Insufficient Session Expiration third-party-advisory
- Submit #857923 | django-oauth django-oauth-toolkit 3.3.0 at commit ddec25b491e52d7f4a1e2cf13a436ffddcf6c782 CWE-613 Insufficient Session Expiration / CWE-287 Improper Authe (Duplicate) third-party-advisory
- https://github.com/django-oauth/django-oauth-toolkit/issues/1715 issue-tracking
- https://github.com/django-oauth/django-oauth-toolkit/ product