CVE-2026-6609 Details
Description
A flaw has been found in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function form_valid of the file oauth/views.py. This manipulation of the argument oauthid causes improper authorization. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
An Insecure Direct Object Reference (IDOR) vulnerability has been identified in liangliangyy DjangoBlog versions through 2.1.0.0. The issue resides in the RequireEmailView within oauth/views.py, where the form_valid function improperly validates the oauthid parameter received from the client-side form. This lack of verification allows an attacker to manipulate the oauthid field to hijack another user's OAuth identity, leading to unauthorized access and account takeover via social authentication.
It is recommended to verify that the oauthid parameter belongs to the current user session before making any modifications. Additionally, consider storing the OAuth ID on the server side in the user's session.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 20, 2026CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/3em0/cve_repo/blob/main/DjangoBlog/Vuln-6-OAuth-Email-Binding-IDOR.md | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/submit/790288 | [email protected] | Technical Description |
| https://vuldb.com/vuln/358244 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/vuln/358244/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| liangliangyy DjangoBlog | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 20, 2026 | New CVE Received | [email protected] |