Executive brief
A security issue in the Django OAuth Toolkit library could allow login sessions and refresh tokens to remain valid longer than intended. By default, the system may allow the use of expired identification tokens during logout processes and fail to enforce a maximum lifetime for refresh tokens. This could allow an attacker with a stolen token to maintain access to a user's account indefinitely or interfere with secure logout procedures.
Technical details
A vulnerability exists in django-oauth-toolkit 3.3.0 due to insecure default settings and insufficient validation in the `_load_id_token` function within `oauth2_provider/oauth2_validators.py`. Specifically, `REFRESH_TOKEN_EXPIRE_SECONDS` defaults to `None`, allowing refresh tokens to persist indefinitely if not manually revoked. Additionally, `OIDC_RP_INITIATED_LOGOUT_ACCEPT_EXPIRED_TOKENS` defaults to `True`, which causes the validator to skip 'exp' and 'nbf' claim checks for `id_token_hint` during RP-initiated logouts. An authenticated remote attacker can exploit these behaviors to maintain long-term access via leaked refresh tokens or use stale ID tokens to drive logout and token deletion flows. As of the advisory date, the project has not yet released a patch.
Affected products
- django-oauth django-oauth-toolkit 3.3.0
Timeline
- 2026-06-13: disclosed: Issue reported to the project maintainers via GitHub
- 2026-07-19: advisory: CVE published to NVD