CVE-2026-114137: Django REST Framework TokenProxy.delete() Fails to Delete Auth Tokens (CVSS 7.4)

Executive Summary

CVE-2026-114137 is a high-severity flaw (CVSS 7.4) in Django REST framework (DRF), the widely used toolkit for building Web APIs on Django. In versions from 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.py does not delete the token it is asked to delete.

Vulnerability Details

Root Cause

TokenProxy is a proxy model over the concrete Token model. The proxy's primary key is the user id, while the concrete Token model identifies rows by the token string primary key. When TokenProxy.delete() runs, Django issues a deletion query keyed on the user-id value, which matches no row in the token table. The call reports success while the token remains valid.

The NVD description is truncated in the source feed, so the exact reported outcome should be confirmed against the full NVD entry and the DRF release notes.

Impact

Code paths that rely on deleting a token through the proxy model, such as the Django admin token management view or custom revocation logic, may believe a credential has been revoked when it has not. A token that an administrator intended to invalidate (for example after a suspected compromise or an employee departure) can continue to authenticate API requests.

Remediation

1. Upgrade Django REST framework to 3.18.2 or later.
2. Audit any recent token revocations performed through the admin interface or TokenProxy. Confirm the rows are gone from the authtoken_token table.
3. Rotate tokens that were meant to be revoked while running an affected version, by deleting them through the concrete Token model or by regenerating them.
4. Consider token expiry or a short-lived-token scheme so that a failed revocation has a bounded lifetime.

References

• NVD entry for CVE-2026-114137