A hard-coded cryptographic key in the Amap API Call handler of liangliangyy DjangoBlog (owntracks/views.py) can be manipulated via an argument key, allowing an attacker to force the application to use the fixed key. This weakness permits the decryption of data encrypted with that key, resulting in a confidentiality compromise. The official description notes that the attack can be launched remotely and that exploitation has already been disclosed publicly.

The vulnerability affects version 2.1.0.0 and earlier of the liangliangyy DjangoBlog project. The affected component is the unknown function in owntracks/views.py responsible for handling Amap API calls. No other vendors or product lines are listed.

The CVSS score of 6.9 indicates a medium severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote HTTP request that supplies a crafted key argument to the affected endpoint, enabling exploitation without local code execution. Given the public disclosure, the risk remains elevated until a secured key implementation or a patched release is applied.