CVE-2026-16206

medium

Description

A security vulnerability has been detected in django-oauth django-oauth-toolkit 3.3.0. This issue affects the function _load_id_token of the file oauth2_provider/oauth2_validators.py. The manipulation leads to session expiration. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

References

https://vuldb.com/vuln/380022/cti

https://vuldb.com/vuln/380022

https://vuldb.com/submit/857923

https://vuldb.com/submit/857897

https://vuldb.com/cve/CVE-2026-16206

https://github.com/django-oauth/django-oauth-toolkit/issues/1715

https://github.com/django-oauth/django-oauth-toolkit/

Details

Source: Mitre, NVD

Published: 2026-07-19

Updated: 2026-07-19

Risk Information

CVSS v2

Base Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 6.3

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Severity: Medium

CVSS v4

Base Score: 5.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.0035