A vulnerability in django‑tastypie's ApiKeyAuthentication allows an attacker to send sensitive authentication data via GET query strings. The CVE description notes that the bug can be exploited remotely with high complexity and difficulty, resulting in credentials being transmitted in the URL. Because query parameters are embedded in the request URL, it is inferred that such sensitive data could be recorded in server logs, browser history, or transmitted in referrer headers, potentially exposing user tokens or passwords.

All installations of django‑tastypie that use the default ApiKeyAuthentication class and are running version 0.15.1 or earlier are affected. This includes any Django project that imports tastypie and relies on the default authentication mechanism, regardless of the deployment environment.

The CVSS score of 6.3 rates the risk as moderate, while the EPSS score of less than 1% indicates a very low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, further suggesting limited exploitation activity. Exploitation requires remotely crafted GET requests containing sensitive query strings, which demands significant attacker effort and is considered difficult. The potential impact is the inadvertent disclosure of authentication credentials, which could lead to unauthorized account access if an attacker reuses those tokens.