In DjangoCRM, the hard‑coded SECRET_KEY found in webcrm/settings.py is used to sign session cookies, generate CSRF tokens, and create password reset tokens. Anyone who can read the public repository obtains this key and can forge valid session cookies for any user, forge CSRF tokens, and produce password‑reset links, resulting in a full account takeover. This flaw is a classic instance of CWE‑798, manifested in the CVSS base score of 9.1.

All installations of DjangoCRM that have not been modified to read the SECRET_KEY from an environment variable are affected, as the repository ships the SECRET_KEY hard‑coded in webcrm/settings.py. The hard‑coded key allows anyone who can read the public repository to forge session cookies, CSRF tokens, and password reset tokens, potentially enabling full account takeover. No evidence is provided that the issue is limited to any specific version or configuration beyond the default settings.

The risk remains high: a CVSS score of 9.1 signals severe impact and a straightforward exploitation path. The EPSS score of < 1% indicates a low current probability of exploitation, though the publicly exposed secret key lets an adversary forge session cookies, CSRF tokens, and password‑reset links without system access. The vulnerability is not included in the CISA KEV catalog, yet the ability to induce full account takeover makes it a priority for immediate resolution.