CVE-2024-22513

What it actually does

Missing user validation checks in the for_user method of djangorestframework-simplejwt allows JWT tokens issued prior to account disablement to remain valid, permitting continued access to protected resources.

Why it matters to the business

Formerly authorized users whose accounts have been disabled can still reach application data and functionality, creating unauthorized access risks and potential regulatory exposure.

How an attack unfolds

An attacker obtains a valid JWT token while the account is active, then continues presenting that token to backend endpoints after the account is disabled; because for_user performs no status check the token grants full access without re-authentication.

How to fix it

Upgrade djangorestframework-simplejwt to the latest release that enforces user validation inside for_user, rotate any long-lived tokens, and add explicit disabled-account checks at the application layer.

How to confirm the fix worked

Confirm the installed package version exceeds 5.3.1, then test that tokens issued to a subsequently disabled account are rejected by protected endpoints.

Typical attack path

1. Obtain a valid JWT token through normal authentication
2. Trigger or observe account disablement
3. Reuse the existing token against protected API endpoints
4. Access resources without triggering account-status checks

How to detect it

Correlate authentication logs with account-disable events and look for continued resource access attempts using tokens issued before the disable timestamp.

What your security team should do

• Immediately upgrade djangorestframework-simplejwt across all environments
• Audit token issuance and refresh logic for disabled-account handling
• Add runtime checks that invalidate tokens when accounts are disabled
• Review logs for post-disable token usage as a short-term control