This vulnerability affects liangliangyy DjangoBlog up to version 2.1.0.0. It arises from improper authorization checks in the form_valid function within oauth/views.py, specifically through manipulation of the oauthid argument. This flaw can be exploited remotely without user interaction or elevated privileges. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Although an exploit is publicly available, the vendor has not issued any advisory or patch, and no official remediation guidance is currently provided.

The vulnerability allows remote attackers to bypass authorization controls by manipulating the oauthid parameter, potentially granting unauthorized access or actions within the DjangoBlog application. The impact is limited to improper authorization with low vector complexity and no required user interaction. There is no indication of privilege escalation or data confidentiality/integrity loss beyond the improper authorization itself.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a patch, users should consider implementing temporary mitigations such as restricting access to the affected oauth functionality, applying custom authorization checks, or disabling the vulnerable feature until an official fix is available. Monitor official channels for updates from the vendor.