CVE-2024-21543
djoser Authentication Bypass
Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.
- Record
CVE-2024-21543- CVSS 4.0
- 5.7 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N/E:P - Weakness
- CWE-287, CWE-295
- Updated
- 2026-11-02
EUVDEUVD-2024-0205
Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.
- Record
EUVD-2024-0205- CVSS 4.0
- 5.7 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-v49p-m6gh-747c
djoser Authentication Bypass
Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.
- Record
GHSA-v49p-m6gh-747c- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-287, CWE-295
- Updated
- 2026-11-02
NVD
Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.
- Record
CVE-2024-21543- CVSS 4.0
- 5.7 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-287, CWE-295
- Updated
- 2026-11-02
OSV
Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.
- Record
CVE-2024-21543- CVSS 4.0
- 5.7 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-21543
Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.
- Record
DEBIAN-CVE-2024-21543- CVSS 4.0
- 5.7 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-v49p-m6gh-747c
djoser Authentication Bypass
Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.
- Record
GHSA-v49p-m6gh-747c- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-287, CWE-295
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-21543
Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.
- Record
UBUNTU-CVE-2024-21543- CVSS 4.0
- 5.7 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
OSVPYSEC-2024-158 No score
Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.
- Record
PYSEC-2024-158- Updated
- 2026-11-02
OSVUSN-7354-1 No score
djoser vulnerability
Diego Cebrián discovered that djoser did not properly handle user authentication. An attacker with valid credentials could possibly use this to bypass authentication checks, such as two-factor authentication, to gain unintended access.
- Record
USN-7354-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
djoserPyPI |
before 2.3.0 | 2.3.0 |
djoserDebian:12 |
before 2.1.0-1+deb12u1, plus listed versions 2.1.0-1 |
2.1.0-1+deb12u1 |
djoserDebian:13 |
before 2.3.1-1 | 2.3.1-1 |
djoserDebian:14 |
before 2.3.1-1 | 2.3.1-1 |
djoserDebian:11 |
before 2.1.0-1+deb11u1, plus listed versions 2.1.0-1 |
2.1.0-1+deb11u1 |
djoserPyPI |
before 2.3.0, plus listed versions 0.0.10.0.20.0.30.1.00.2.0 Show 41 moreShow less0.2.10.3.00.3.10.3.20.4.00.4.10.4.20.4.30.5.00.5.10.5.20.5.30.5.40.6.00.7.01.0.01.0.11.1.01.1.11.1.21.1.31.1.41.1.51.2.21.3.31.4.11.5.11.6.01.7.02.0.02.0.12.0.22.0.32.0.42.0.52.1.02.2.02.2.0a02.2.12.2.22.2.3 |
2.3.0 |
djoserPyPI |
before 2.3.0, plus listed versions 0.0.10.0.20.0.30.1.00.2.0 Show 45 moreShow less0.2.10.3.00.3.10.3.20.4.00.4.10.4.20.4.30.5.00.5.10.5.20.5.30.5.40.6.00.7.01.0.01.0.11.1.01.1.11.1.21.1.31.1.41.1.51.2.21.3.31.4.11.5.11.6.01.7.02.0.02.0.12.0.22.0.32.0.42.0.52.1.02.2.02.2.0a02.2.12.2.22.2.31.4.01.3.21.2.11.5.0 |
2.3.0 |
djoserUbuntu:Pro:20.04:LTS |
before 2.0.3-1ubuntu0.1~esm1, plus listed versions 2.0.1-22.0.3-1 |
2.0.3-1ubuntu0.1~esm1 |
djoserUbuntu:22.04:LTS |
before 2.1.0-1ubuntu0.22.04.1, plus listed versions 2.1.0-1 |
2.1.0-1ubuntu0.22.04.1 |
djoserUbuntu:24.04:LTS |
before 2.1.0-1ubuntu0.24.04.1, plus listed versions 2.1.0-1 |
2.1.0-1ubuntu0.24.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-21543 is a medium vulnerability (CVSS 5.7) in djoser, published December 13, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in djoser 2.3.0.
References
security.snyk.io/vuln/SNYK-PYTHON-DJOSER-8366540
github.com/sunscrapers/djoser/releases/tag/2.3.0
lists.debian.org/debian-lts-announce/2025/02/msg00023.html
Show 9 moreShow less
nvd.nist.gov/vuln/detail/CVE-2024-21543
security-tracker.debian.org/tracker/CVE-2024-21543
ubuntu.com/security/CVE-2024-21543
cve.org/CVERecord?id=CVE-2024-21543
Left out here: 2 versions. The JSON record has them.