In DjangoCRM, the project includes a hard-coded Django SECRET_KEY inside webcrm/settings.py. This key is used for signing session cookies, generating CSRF tokens, and creating password reset tokens. Anyone who can read the public repository obtains the key and can fabricate valid session cookies for any user, forge CSRF tokens, and produce valid password reset links. The result is a full account takeover, allowing unrestricted access to the application. This flaw is a classic instance of CWE-798, manifesting with a CVSS base score of 9.1.

All installations of DjangoCRM that rely on the default settings are affected, as the repository ships the SECRET_KEY hard-coded and sets DEBUG=True. The default configuration causes error pages to expose database credentials, email settings, OAuth data, and internal file paths. The vulnerability is therefore present in every copy of the repository that has not been modified to read the key from an environment variable or to disable debugging in production.

The risk is high: the CVSS score of 9.1 reflects severe impact and an easy exploitation path. Because the key is publicly visible, the attack does not require any system access and can be performed by any actor who can clone the repository. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the exposure of credentials and the ability to forge authentication tokens makes the potential for exploitation extremely likely. Administrators should treat this as an immediate security emergency.