CVE-2026-71238

9.1 CRITICALpublic exploit available

Published 2026-08-05 · Updated 2026-08-10

AI risk analysis

Summary: The flaw involves a hardcoded Django SECRET_KEY in the codebase, allowing attackers to forge session cookies and tokens, leading to full account takeover.
Exploitability: Exploitation is relatively easy as anyone with access to the public repository can read the key. Precondition: The application must be running without proper environment variable configuration.
Blast radius: If exploited, this could result in unauthorized access to superadmin accounts and other sensitive data across all users.
Prioritized remediation: Move the Django SECRET_KEY to an environment variable to prevent hardcoding it in the source code.

auth-bypasswebsecurity-config

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens, achieving full account takeover.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-798

Public exploit & PoC references

https://github.com/DjangoCRM/django-crm

All references

https://github.com/DjangoCRM/django-crm

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.