CVE-2026-16215
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A security flaw was discovered in django-jet up to version 1.0.8 in the OAuth Credential Revoke Handler component. Missing authorization in this function allows remote attacks without required privileges. The exploit has been publicly released and may be used in real attacks.
Risk Assessment
The organization is exposed to remote unauthorized revocation of OAuth credentials, which could lead to disruption of authentication services and potential account takeover.
Recommendation
Immediately update django-jet to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the OAuth credential revocation function or apply WAF rules to block known exploits.
Other vulnerabilities in django-jet
See all- CVE-2026-16216Medium
In geex-arts django-jet up to version 1.0.8, a cross-site request forgery vulnerability exists in the OAuth Handler component. The attack can be performed remotely, and the exploit is publicly available. The project was notified but has not responded.
- CVE-2026-16214Medium
A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/dashboard/views.py of the component Dashboard Module. Such manipulation leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Original NVD description (English source)
A security flaw has been discovered in geex-arts django-jet up to 1.0.8. This impacts an unknown function of the component OAuth Credential Revoke Handler. Performing a manipulation results in missing authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.