Django Rest Framework jwt allows obtaining new token from notionally invalidated token
Critical severity
GitHub Reviewed
Published
Jun 5, 2020
to the GitHub Advisory Database
•
Updated Aug 23, 2023
Description
Published by the National Vulnerability Database
Mar 15, 2020
Reviewed
Jun 4, 2020
Published to the GitHub Advisory Database
Jun 5, 2020
Last updated
Aug 23, 2023
An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained.
References