In Django REST framework from 3.12.0 through 3.18.1 the TokenProxy.delete() method uses the proxy object's user‑id primary key while the token string primary key identifies rows. Consequently Django issues a deletion query that matches no row and reports zero deletions while raising no error. Applications, administrators, or scripts that revoke credentials via a TokenProxy instance may mistakenly believe the revoke succeeded, but the token remains active and can continue authenticating.

Django REST framework released between versions 3.12.0 and 3.18.1, inclusive, is affected. The issue is resolved starting with version 3.18.2.

The CVSS score of 7.4 indicates a high severity impact on confidentiality and integrity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via any client, administrative integration, or operational script that calls TokenProxy.delete() to revoke credentials, inferred from the description. Exploitation does not require additional conditions beyond access to the delete operation.