Skip to content
OpenAdvisories
High USN-7354-1 1 CVE

djoser vulnerability

Published Mar 17, 2025 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Diego Cebrián discovered that djoser did not properly handle user
authentication. An attacker with valid credentials could possibly
use this to bypass authentication checks, such as two-factor
authentication, to gain unintended access.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS djoser 2.1.0-1ubuntu0.22.04.1
Ubuntu · 24.04 LTS 24.04:LTS djoser 2.1.0-1ubuntu0.24.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS djoser 2.0.3-1ubuntu0.1~esm1

Vulnerabilities 1

  • High 7.1
    CVE-2024-21543

    djoser Authentication Bypass

    Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventuall…

    djoser djoser djoser Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2024-21543