Information Exposure Affecting djangorestframework-simplejwt package, versions [0,]

djangorestframework-simplejwt is an A minimal JSON Web Token authentication plugin for Django REST Framework

Affected versions of this package are vulnerable to Information Exposure due to improper handling of sensitive information. An attacker can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method.

Ensure that before generating an access token for a user, there is a thorough verification process to determine whether the user is active or not. This validation step is essential in preventing unauthorized access and helps mitigate the vulnerability associated with the lack of user inactivity validation in the mentioned functionality. Implementing this check adds an extra layer of security to your application.

from django.contrib.auth.models import User
from rest_framework_simplejwt.tokens import AccessToken

user = User.objects.get(id=inactive_user_id)
if user and user.is_active: 
    token = AccessToken.for_user(user)

• Github Issue
• Security Advisory
• Exploit DB