CVE-2026-6578

liangliangyy DjangoBlog Setting settings.py hard-coded credentials

View on CVE.org
Published Apr 19, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Description
A security flaw has been discovered in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the file djangoblog/settings.py of the component Setting Handler. The manipulation of the argument SECRET_KEY results in hard-coded credentials. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

A flaw in liangliangyy DjangoBlog versions up to 2.1.0.0 allows an attacker to read or alter the hard‑coded SECRET_KEY value in settings.py. The hard‑coded credential can be used by an attacker to influence Django’s signing mechanism, potentially enabling the creation of valid session or token values. The CVSS score of 6.3 indicates a moderate severity for this credential exposure.

Affected Systems

The vulnerability affects the liangliangyy DjangoBlog product, all releases up to and including 2.1.0.0. It resides in the settings.py file within the setting handler component of the application.

Risk and Exploitability

The attack can be launched remotely by manipulating the argument that controls SECRET_KEY, but the CVE notes that exploitation requires a high level of complexity and is considered difficult. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The availability of the exploit code in public repositories increases the risk for any exposed deployment.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Generate a cryptographically secure random secret key using Django's built‑in utility and replace the hard‑coded value in settings.py
  • Configure the application to read the secret key from an environment variable such as DJANGO_SECRET_KEY rather than committing it in source code
  • Restart the application to ensure it loads the new key from the environment
  • Audit the codebase for additional hard‑coded secrets or credentials
  • Implement monitoring for unusual authentication or session activity to detect potential misuse

Generated by OpenCVE AI on April 19, 2026 at 22:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Liangliangyy
Liangliangyy djangoblog
Vendors & Products Liangliangyy
Liangliangyy djangoblog
Type Values Removed Values Added
Description A security flaw has been discovered in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the file djangoblog/settings.py of the component Setting Handler. The manipulation of the argument SECRET_KEY results in hard-coded credentials. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title liangliangyy DjangoBlog Setting settings.py hard-coded credentials
Weaknesses CWE-259
CWE-798
References
Metrics cvssV2_0

{'score': 5.1, 'vector': 'AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.6, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-259

    Use of Hard-coded Password

  • CWE-798

    Use of Hard-coded Credentials

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 20, 2026, 4:12 PM
Reserved
Apr 19, 2026, 5:10 AM

View source JSON

Updated
Apr 20, 2026, 4:12 PM

JSON

Status
Deferred
Published
Apr 19, 2026, 10:16 PM
Modified
Oct 26, 2026, 9:10 PM

View source JSON

No data.

Updated
Apr 20, 2026, 2:58 PM

JSON