vulnerability
Debian: CVE-2024-21543: djoser -- security update
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 8 | (AV:N/AC:L/Au:S/C:C/I:P/A:N) | Dec 13, 2024 | Feb 24, 2025 | Aug 15, 2025 |
Severity
8
CVSS
(AV:N/AC:L/Au:S/C:C/I:P/A:N)
Published
Dec 13, 2024
Added
Feb 24, 2025
Modified
Aug 15, 2025
Description
Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.
Solution
debian-upgrade-djoser
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.