CVE-2026-114137 encode CVE debrief

Who should care

Defenders responsible for managing authentication tokens, administrators of systems using Django REST framework, and developers who use TokenProxy to revoke tokens should be aware of this issue and take steps to verify and remediate it.

Why it matters

The CVE-2026-114137 vulnerability in Django REST framework allows authentication tokens to be silently not revoked, potentially leading to unauthorized access. Defenders should prioritize verifying and remediating this issue.

• Potential unauthorized access via tokens that were not properly revoked.
• Increased risk of authentication bypass due to silent failure of token deletion.
• Need for verification of token revocation processes to ensure proper deletion.

Technical summary

The TokenProxy model in Django REST framework has a delete method that reports success but silently fails to delete the associated token. This is due to the model's pk property returning the user ID instead of the token key, causing the delete query to not match any rows in the database. The issue arises from a mismatch in the primary key used for deletion, resulting in the token not being revoked as expected, potentially allowing for continued unauthorized access. The affected product context is Django REST framework versions 3.12.0 to 3.18.1, and defenders should prioritize verifying and remediating this issue to prevent potential unauthorized access.

Defensive priority

Defenders should prioritize verifying and remediating this issue, as it allows authentication tokens to be silently not revoked, potentially leading to unauthorized access.

Recommended defensive actions

• Verify if the Django REST framework is used in the environment and if the version is within the affected range (3.12.0 to 3.18.1).
• Check if any applications, admin integrations, or operational scripts are using the TokenProxy.delete() method to revoke tokens.
• Consider upgrading to version 3.18.2 or later, which includes a fix for this issue.
• Implement additional monitoring to detect potential unauthorized access via tokens that were not properly revoked.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The issue arises from the TokenProxy model's delete method not properly deleting the associated token due to a mismatch in the primary key used for deletion. This results in the token not being revoked as expected, potentially allowing for continued unauthorized access.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.