CVE-2026-16216
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In geex-arts django-jet up to version 1.0.8, a cross-site request forgery vulnerability exists in the OAuth Handler component. The attack can be performed remotely, and the exploit is publicly available. The project was notified but has not responded.
Risk Assessment
An attacker can use CSRF to perform unauthorized actions on behalf of an authenticated user, potentially leading to account takeover or data modification.
Recommendation
Apply a patch or temporarily disable the OAuth Handler component if possible. Monitor for project updates.
Other vulnerabilities in django-jet
See all- CVE-2026-16215Medium
A security flaw was discovered in django-jet up to version 1.0.8 in the OAuth Credential Revoke Handler component. Missing authorization in this function allows remote attacks without required privileges. The exploit has been publicly released and may be used in real attacks.
- CVE-2026-16214Medium
A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/dashboard/views.py of the component Dashboard Module. Such manipulation leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Original NVD description (English source)
A weakness has been identified in geex-arts django-jet up to 1.0.8. Affected is an unknown function of the component OAuth Handler. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.