WS-2026-0107

Django REST framework 3.12.0 before 3.18.2: TokenProxy.pk returns the user id instead of the token key, so deleting a token through the admin or TokenProxy.delete reports success but revokes nothing and the token stays valid. GHSA-xw6w-gcfp-cf8m...