Description
A security vulnerability has been detected in django-oauth django-oauth-toolkit 3.3.0. This issue affects the function _load_id_token of the file oauth2_provider/oauth2_validators.py. The manipulation leads to session expiration. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| django-oauth | django-oauth-toolkit | 3.3.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-django-oauth-toolkit | 3.4.1-1.1 | openSUSE-SU-2026:11624-1 |
Advisories 1
- openSUSE-SU-2026:11624-1 python313-django-oauth-toolkit-3.4.1-1.1 on GA media SUSE / openSUSE Security Updates · Aug 28, 2026
References
- VDB-380022 | django-oauth django-oauth-toolkit oauth2_validators.py _load_id_token session expiration vdb-entry technical-description
- VDB-380022 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-16206 | CVE Analysis and Report third-party-advisory
- Submit #857897 | django-oauth django-oauth-toolkit 3.3.0 at commit ddec25b491e52d7f4a1e2cf13a436ffddcf6c782 CWE-613 Insufficient Session Expiration third-party-advisory
- Submit #857923 | django-oauth django-oauth-toolkit 3.3.0 at commit ddec25b491e52d7f4a1e2cf13a436ffddcf6c782 CWE-613 Insufficient Session Expiration / CWE-287 Improper Authe (Duplicate) third-party-advisory
- https://github.com/django-oauth/django-oauth-toolkit/issues/1715 issue-tracking
- https://github.com/django-oauth/django-oauth-toolkit/ product