Django REST framework: Token revocation failure (CVE-2026-114137)

Django REST framework versions 3.12.0 to 3.18.1 contain a logic vulnerability in the TokenProxy.delete() method within rest_framework/authtoken/models.py. The method incorrectly uses the user ID primary key instead of the token string primary key when executing database deletion queries. As a result, the query fails to locate the target record and reports zero deletions without triggering an error or exception.

Any application, administrative integration, or operational script relying on this method to revoke access will incorrectly process the operation as successful. Because Django REST framework tokens do not expire automatically, this vulnerability allows revoked or compromised tokens to remain active indefinitely, granting continued unauthorized access to APIs. This issue is fixed in version 3.18.2.

Impact

Attackers can maintain persistent access to APIs despite administrator attempts to revoke their credentials. The silent failure prevents security monitoring tools or automated lifecycle management scripts from detecting that the token remains valid in the database.

Recommendation

• Upgrade Django REST framework to version 3.18.2 or later immediately.
• Audit custom scripts, management commands, and administrative API integrations that perform token revocation to ensure they do not rely on TokenProxy.delete().
• For affected systems, perform a database audit to identify orphaned or unintended active tokens that were mistakenly thought to be deleted by automated processes.
• Transition to using explicit record deletion methods, such as Token.objects.filter(key=...).delete(), which correctly target the token string primary key.