CVE-2026-114137

The Django REST framework (versions 3.12.0 through 3.18.2) contains a flaw in rest_framework/authtoken/models.py where the TokenProxy.delete() method incorrectly reports success without actually revoking any tokens. The root cause is that the method uses the proxy's user-id pk instead of the toke...