The vulnerability resides in the _load_id_token function of oauth2_validators.py in django-oauth-toolkit 3.3.0. A crafted input can cause a valid user session to expire prematurely. This results in a forced logout or interruption of the authentication flow, preventing users from continuing their activity without re‑authenticating. The weakness is classified as CWE-613, insufficient session expiration.

The affected product is Django‑OAuth‑Toolkit version 3.3.0 from the django‑oauth family. No other version information is provided, and it is unknown whether later releases address the issue.

The CVSS score of 5.3 indicates moderate risk, and the EPSS score of less than 1% suggests exploitation is unlikely but not impossible. Since the description states that the attack can be initiated remotely and does not require privileged access, it is inferred that any user able to send custom requests to the endpoint that invokes _load_id_token could exploit the flaw. The issue is not listed in CISA KEV, but administrators should consider the potential for service disruption and evaluate the threat within their environment.