CVE-2026-16215 describes a missing authorization vulnerability in the OAuth Credential Revoke Handler of geex-arts django-jet up to version 1.0.8. This security flaw allows remote attackers to manipulate the component without proper authorization, potentially leading to unauthorized revocation of OAuth credentials or related impacts. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, and limited impact on confidentiality, integrity, and availability. The vendor has been notified but has not yet provided a remediation or patch. Public exploit code is available, which may facilitate attacks.

The vulnerability enables remote attackers to bypass authorization controls in the OAuth Credential Revoke Handler, potentially allowing unauthorized revocation of OAuth credentials or other unauthorized actions within the affected component. This could lead to disruption of OAuth-based authentication flows or unauthorized access revocation. The impact is rated medium severity with limited confidentiality, integrity, and availability impact as per the CVSS vector.

No official fix or patch is currently available from the vendor. Since the vendor has not responded or issued a remediation, users should monitor the vendor's channels for updates. Until a patch is released, consider restricting access to the OAuth Credential Revoke Handler endpoint or implementing additional authorization checks at the application or network level to mitigate unauthorized access.