CVE-2026-71238

DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery

View on CVE.org
Published Aug 5, 2026 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Description
DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens, achieving full account takeover.

Analysis

AI-generated

Technical impact

In DjangoCRM, the hard‑coded SECRET_KEY found in webcrm/settings.py is used to sign session cookies, generate CSRF tokens, and create password reset tokens. Anyone who can read the public repository obtains this key and can forge valid session cookies for any user, forge CSRF tokens, and produce password‑reset links, resulting in a full account takeover. This flaw is a classic instance of CWE‑798, manifested in the CVSS base score of 9.1.

Affected Systems

All installations of DjangoCRM that have not been modified to read the SECRET_KEY from an environment variable are affected, as the repository ships the SECRET_KEY hard‑coded in webcrm/settings.py. The hard‑coded key allows anyone who can read the public repository to forge session cookies, CSRF tokens, and password reset tokens, potentially enabling full account takeover. No evidence is provided that the issue is limited to any specific version or configuration beyond the default settings.

Risk and Exploitability

The risk remains high: a CVSS score of 9.1 signals severe impact and a straightforward exploitation path. The EPSS score of < 1% indicates a low current probability of exploitation, though the publicly exposed secret key lets an adversary forge session cookies, CSRF tokens, and password‑reset links without system access. The vulnerability is not included in the CISA KEV catalog, yet the ability to induce full account takeover makes it a priority for immediate resolution.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update DjangoCRM to a version where the SECRET_KEY is removed from source code and read from an environment variable or a secure secrets manager.
  • Regenerate the SECRET_KEY and rotate all database, email, OAuth, and other credentials; deploy the new key and update all instances.
  • Review repository history and configuration files to ensure the SECRET_KEY is not present in any committed source files, and remove it from any public repositories or logs.

Generated by OpenCVE AI on August 10, 2026 at 21:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
References
Link Providers
https://github.com/DjangoCRM/django-crm cve-icon cve-icon
History
Type Values Removed Values Added
Description DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens, achieving full account takeover. The repository also ships with DEBUG=True as the default, causing error pages to leak database credentials, email credentials, OAuth data, and internal file paths. DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens, achieving full account takeover.
Type Values Removed Values Added
Title DjangoCRM: Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery
Type Values Removed Values Added
First Time appeared Djangocrm
Djangocrm django-crm
Vendors & Products Djangocrm
Djangocrm django-crm
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens, achieving full account takeover. The repository also ships with DEBUG=True as the default, causing error pages to leak database credentials, email credentials, OAuth data, and internal file paths.
Title DjangoCRM: Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery
Weaknesses CWE-798
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}
Weaknesses
  • CWE-798

    Use of Hard-coded Credentials

Sources

Status
PUBLISHED
Assigner
TuranSec
Published
Updated
Aug 10, 2026, 11:45 AM
Reserved
Aug 5, 2026, 10:53 AM

View source JSON

Updated
Aug 5, 2026, 12:43 PM

JSON

Status
Deferred
Published
Aug 5, 2026, 11:16 AM
Modified
Oct 24, 2026, 3:10 PM

View source JSON

No data.

Updated
Aug 10, 2026, 10:00 PM

JSON