AIKIDO-2026-600799
django-oauth-toolkit is vulnerable to Use of Insufficiently Random Values
53
Medium Risk
This Affects:
django-oauth-toolkitTL;DR
The OAuth 2.0 device authorization grant generates the user_code credential with the non-cryptographic random module (Mersenne Twister), whose output is predictable once its internal state is inferred. The device views look up pending grants solely by user_code, so a guessable code lets an attacker bind or hijack a device authorization. The fix draws each character from the cryptographically secure secrets module as required by RFC 8628.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your deployment enables the OAuth 2.0 device authorization grant.
Background info
django-oauth-toolkit is vulnerable to Use of Insufficiently Random Values in versions 3.2.0 - 3.3.0.
How to fix this
Upgrade the django-oauth-toolkit library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant