CVE-2026-114137

The Django REST framework (versions 3.12.0 through 3.18.2) contains a flaw in rest_framework/authtoken/models.py where the TokenProxy.delete() method incorrectly reports success without actually revoking any tokens. The root cause is that the method uses the proxy's user-id pk instead of the toke...

CVE-2026-114137 Django REST framework: TokenProxy.delete() reports success and revokes nothing

Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete in restframework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and repor...

CVE-2026-114137 Django REST framework: TokenProxy.delete() reports success and revokes nothing

Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete in restframework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and repor...