The vulnerability resides in the form_valid function in oauth/views.py of the DjangoBlog application. By altering the oauthid argument, an attacker can circumvent normal authorization checks, allowing unauthorized binding of OAuth credentials and potentially accessing or modifying resources they should not be allowed to. The flaw is exploitable remotely, has already been publicly described and an exploit has been released, and the vendor has not provided a fix or response.

Any deployment of liangliangyy's DjangoBlog up to and including version 2.1.0.0 is affected. The issue specifically targets the OAuth handling logic within the oauth/views.py file, so installations running this codebase without protection are vulnerable.

The CVSS score of 5.3 indicates a moderate severity vulnerability. The EPSS score is not available, so the current exploitation likelihood is unclear; however, the flaw is publicly documented and a working exploit exists. The vulnerability is not listed in the CISA KEV catalog. Attackers can initiate the exploit remotely, which increases the threat surface. The improper authorization mechanism is rooted in CWE‑266 (Untrusted Modification of Authorization Tokens) and CWE‑285 (Authorization Bypass Through User-Controlled Key).