CVE-2026-6578 Details
Description
A security flaw has been discovered in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the file djangoblog/settings.py of the component Setting Handler. The manipulation of the argument SECRET_KEY results in hard-coded credentials. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability exists in Liangliangyy DjangoBlog versions through 2.1.0.0, where the SECRET_KEY in djangoblog/settings.py is hardcoded. This fallback is used when the DJANGO_SECRET_KEY environment variable is not set, leading to the use of a globally known secret. The hardcoded key is utilized to sign session cookies, CSRF tokens, password reset tokens, and email confirmation signatures. An attacker aware of this key can forge session cookies to impersonate any user, including superadmins, bypass CSRF protections, and take over accounts by forging email verification signatures. The vulnerability can be exploited remotely, and a public exploit is available.
It is recommended to remove the hardcoded fallback value for the SECRET_KEY. The DJANGO_SECRET_KEY should be set as a mandatory environment variable, and the application should fail to start if this variable is absent.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 19, 2026CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/3em0/cve_repo/blob/main/DjangoBlog/Vuln-3-Hardcoded-Django-SECRET_KEY.md | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/submit/790283 | [email protected] | Technical Description |
| https://vuldb.com/vuln/358213 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/vuln/358213/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-259 | Use of Hard-coded Password | [email protected] |
| CWE-798 | Use of Hard-coded Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| liangliangyy DjangoBlog | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 19, 2026 | New CVE Received | [email protected] |