CVE-2026-6580 Details
Description
A security vulnerability has been detected in liangliangyy DjangoBlog up to 2.1.0.0. Affected is an unknown function of the file owntracks/views.py of the component Amap API Call Handler. Such manipulation of the argument key leads to use of hard-coded cryptographic key . The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability exists in Liangliangyy DjangoBlog versions up to 2.1.0.0, where a hardcoded Amap (Gaode Maps) API key is exposed in the file owntracks/views.py. This vulnerability allows for unauthorized Amap API calls, which could lead to unexpected costs and misuse of location data. The issue can be exploited remotely without any authentication.
It is recommended to move the Amap API key to an environment variable and rotate the exposed key immediately.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 19, 2026CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/3em0/cve_repo/blob/main/DjangoBlog/Vuln-5-Hardcoded-Amap-API-Key.md | [email protected] | RemedyTechnical Analysis |
| https://vuldb.com/submit/790287 | [email protected] | ExploitTechnical Description |
| https://vuldb.com/vuln/358215 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/vuln/358215/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-320 | Key Management Errors | [email protected] |
| CWE-321 | Use of Hard-coded Cryptographic Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| liangliangyy DjangoBlog | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 19, 2026 | New CVE Received | [email protected] |