CVE-2026-114137

What it actually does

TokenProxy.delete() in rest_framework/authtoken/models.py issues a DELETE using the proxy's user-id PK instead of the Token table's token-string PK, resulting in a no-op query that returns zero rows deleted without error or exception.

Why it matters to the business

Revocation of API credentials can silently fail, leaving tokens active indefinitely and enabling continued unauthorized access; the issue affects recent releases and has shown a 35% rise in exploitation probability over the last 30 days.

How an attack unfolds

An attacker obtains a valid DRF token, continues using it after an administrative or script-based revocation attempt that relies on TokenProxy, and authenticates successfully because the underlying row was never removed.

How to fix it

Upgrade Django REST framework to version 3.18.2 or later; replace any custom revocation code that instantiates TokenProxy with direct Token model operations or the TokenAdmin.delete_model pattern.

How to confirm the fix worked

Confirm the installed DRF version is 3.18.2+, execute a test revocation via TokenProxy and verify the token row is actually removed from the database, and review any custom revocation scripts for TokenProxy usage.

Typical attack path

1. Obtain or compromise a DRF authentication token
2. Trigger a revocation operation that uses a TokenProxy instance
3. Observe the operation completing with a reported success or zero-error state
4. Reuse the still-valid token for subsequent authenticated requests

How to detect it

Search application and database logs for TokenProxy deletion attempts that report zero rows affected; correlate continued successful authentications using tokens that were the target of recent revocation calls; inspect code and runtime traces for references to rest_framework/authtoken/models.py TokenProxy.

• TokenProxy.delete
• rest_framework/authtoken/models.py
• zero deletions
• TokenProxy

What your security team should do

• Immediately upgrade all Django REST framework installations to 3.18.2 or newer
• Audit application and operational code for direct use of TokenProxy.delete() or similar proxy-based revocation
• Implement logging around token deletion operations that alerts on zero-row outcomes
• Review all active tokens for any that should have been revoked since the vulnerable versions were in use