liangliangyy DjangoBlog up to 2.1.0.0 Setting djangoblog/settings.py SECRET_KEY hard-coded credentials

Summaryinfo

A vulnerability identified as critical has been detected in liangliangyy DjangoBlog up to 2.1.0.0. This impacts an unknown function of the file djangoblog/settings.py of the component Setting Handler. This manipulation of the argument SECRET_KEY causes hard-coded credentials. This vulnerability appears as CVE-2026-6578. The attack may be initiated remotely. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

Detailsinfo

A vulnerability has been found in liangliangyy DjangoBlog up to 2.1.0.0 and classified as critical. Affected by this vulnerability is some unknown functionality of the file djangoblog/settings.py of the component Setting Handler. The manipulation of the argument SECRET_KEY with an unknown input leads to a hard-coded credentials vulnerability. The CWE definition for the vulnerability is CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. As an impact it is known to affect confidentiality, integrity, and availability.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-6578. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known. MITRE ATT&CK project uses the attack technique T1110.001 for this issue.

It is possible to download the exploit at github.com. It is declared as proof-of-concept. The vendor was contacted early about this disclosure but did not respond in any way.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-23710). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Content Management System

Vendor

• liangliangyy

Name

• DjangoBlog

Version

• 2.1.0

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #790283: liangliangyy DjangoBlog Hardcoded Credentials Hardcoded Credentials (by Dem0)

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion