{"id":"CVE-2020-10594","aliases":["EUVD-2020-0074","GHSA-fpjm-rp2g-3r4c","PYSEC-2020-40"],"status":"published","title":"Django Rest Framework jwt allows obtaining new token from notionally invalidated token","description":"An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01615,"percentile":0.76201,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2020-03-15T21:22:09Z","modified":"2026-11-10T02:30:23Z","fixes":[{"ecosystem":"PyPI","package":"drf-jwt","fixed_in":["1.15.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"drf-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0"},{"fixed":"1.15.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"drf-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0"},{"fixed":"1.15.1"}]}],"versions":["1.15.0"]},{"source":"osv","ecosystem":"PyPI","package":"drf-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0"},{"fixed":"1.15.1"}]}],"versions":["1.15.0"]}],"products":[{"vendor":"styria","product":"django-rest-framework-json_web_tokens"}],"references":[{"url":"https://github.com/Styria-Digital/django-rest-framework-jwt/issues/36","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://pypi.org/project/drf-jwt/1.15.1/#history","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web","package"]},{"url":"https://github.com/jpadilla/django-rest-framework-jwt/issues/484","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10594","tags":["advisory"]},{"url":"https://github.com/Styria-Digital/django-rest-framework-jwt/commit/868b5c22ddad59772b447080183e7c7101bb18e0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fpjm-rp2g-3r4c","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/drf-jwt/PYSEC-2020-40.yaml","tags":["web"]},{"url":"https://github.com/Styria-Digital/django-rest-framework-jwt","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-10594","description":"An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained.","status":"published","published":"2020-03-15T21:22:09Z","modified":"2024-08-04T11:06:09.995Z","updated_at":"2026-11-02T14:35:47.877975Z"}],"euvd":[{"id":"EUVD-2020-0074","description":"An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained.","status":"published","published":"2020-03-15T21:22:09Z","modified":"2024-08-04T11:06:09Z","updated_at":"2026-11-03T03:07:50.360823Z"}],"ghsa":[{"id":"GHSA-fpjm-rp2g-3r4c","title":"Django Rest Framework jwt allows obtaining new token from notionally invalidated token","description":"An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained.","status":"published","published":"2020-06-05T16:09:34Z","modified":"2024-09-20T17:05:27Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:38:04.690827Z"}],"nvd":[{"id":"CVE-2020-10594","description":"An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained.","status":"published","published":"2020-03-15T22:15:14.13Z","modified":"2026-06-17T02:48:03.807Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:05:55.32877Z"}],"osv":[{"id":"CVE-2020-10594","description":"An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained.","status":"published","published":"2020-03-15T22:15:14.13Z","modified":"2026-11-10T02:30:23.513965793Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-10T02:46:00.217055Z"},{"id":"GHSA-fpjm-rp2g-3r4c","title":"Django Rest Framework jwt allows obtaining new token from notionally invalidated token","description":"An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained.","status":"published","published":"2020-06-05T16:09:34Z","modified":"2025-02-21T05:30:03.59605Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"PYSEC-2020-40","description":"An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained.","status":"published","published":"2020-03-15T22:15:00Z","modified":"2023-11-08T04:01:58.465385Z","updated_at":"2026-11-02T15:52:52.682031Z"}]}}