CVE-2026-71238
DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery
- State
- Published
- Severity
- 9.1 Critical
- Published
- Aug 5, 2026
- Updated
- Aug 10, 2026
- Reserved
- Aug 5, 2026
Description
DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens, achieving full account takeover.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | TuranSec |
Weaknesses
- CWE-798 Use of Hard-coded Credentials
Affected Products
| Product | Versions |
|---|---|
django-crmDjangoCRM |
|
References
- https://github.com/DjangoCRM/django-crmthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.