A flaw in the OAuth Credential Revoke Handler of geex‑arts django‑jet versions up to 1.0.8 enables an attacker to manipulate requests and cause missing authorization checks, which can result in unauthorized revocation of OAuth credentials. This breach falls under missing or insufficient authorization weaknesses (CWE‑862 and CWE‑863) and undermines the integrity of the authentication and authorization process. The impact is that an attacker could revoke valid OAuth tokens without proper authentication, potentially preventing legitimate users from accessing protected resources or allowing an attacker to further exploit the revoked credentials for other attacks.

The vulnerability affects geex‑arts django‑jet up to and including version 1.0.8. The component involved is the OAuth Credential Revoke Handler within the Django‑jet package. No other releases are listed as affected.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is less than 1 %, implying a low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog, yet the exploit is publicly available and can be performed remotely by sending crafted requests to the revocation endpoint. It is inferred that authentication is not required to trigger the missing authorization, which makes the attack vector readily exploitable if the endpoint remains exposed.