CVE-2024-21543

What it actually does

When the package's authenticate() function fails, the code falls back to a direct database query using supplied credentials, granting access while skipping any configured custom authentication backends such as two-factor authentication or LDAP.

Why it matters to the business

Attackers with valid usernames and passwords can reach protected resources without completing required secondary authentication steps, increasing the chance of account takeover and unauthorized data access.

How an attack unfolds

An attacker supplies a valid username and password to an application using the vulnerable djoser version; the authenticate() call fails or is not reached, causing the fallback direct database lookup to succeed and return an authenticated session that bypasses all AUTHENTICATION_BACKENDS checks.

How to fix it

Upgrade sunscrapers/djoser to commit d33c3993c0c735f23cbedc60fa59fce69354f19d or later release 2.3.0 or newer; verify that custom AUTHENTICATION_BACKENDS are still invoked on every login attempt after the upgrade.

How to confirm the fix worked

After upgrade, attempt login with credentials that require a custom backend (for example 2FA) and confirm the backend is still enforced; review application dependency manifests to ensure no older djoser versions remain.

Typical attack path

1. Identify an application endpoint that accepts username/password via djoser authentication views
2. Submit valid credentials that would normally be rejected or augmented by custom backends
3. Observe successful session creation despite missing 2FA, LDAP, or other backend requirements
4. Use the resulting authenticated session to access protected resources or APIs

How to detect it

Review web server and application logs for successful authentication events that lack corresponding records from secondary backends such as OTP or LDAP queries; compare timestamps of login success against expected custom backend calls.

What your security team should do

• Immediately upgrade all djoser installations to the fixed commit or 2.3.0
• Audit authentication logs for any successful logins that bypassed secondary factors in the past 30 days
• Add automated dependency scanning to CI pipelines to prevent future vulnerable versions
• Test authentication flows in staging that exercise all configured backends before deploying the fix