{"id":"CVE-2026-71238","published":"2026-08-05T11:16:26.630","lastModified":"2026-08-10T12:17:26.307","description":"DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens, achieving full account takeover.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-798"],"vendors":[],"products":[],"references":[{"url":"https://github.com/DjangoCRM/django-crm","tags":[]}],"exploitRefs":[{"url":"https://github.com/DjangoCRM/django-crm","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw involves a hardcoded Django SECRET_KEY in the codebase, allowing attackers to forge session cookies and tokens, leading to full account takeover.","exploitability":"Exploitation is relatively easy as anyone with access to the public repository can read the key. Precondition: The application must be running without proper environment variable configuration.","blast_radius":"If exploited, this could result in unauthorized access to superadmin accounts and other sensitive data across all users.","remediation":"Move the Django SECRET_KEY to an environment variable to prevent hardcoding it in the source code.","tags":["auth-bypass","web","security-config"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T06:45:21.350Z"}}