CVE-2020-10594

CVE-2020-10594 describes a critical vulnerability in drf-jwt versions 1.15.x prior to 1.15.1, a fork of the unmaintained jpadilla/django-rest-framework-jwt. This flaw allows an attacker with a notionally invalidated token to bypass blacklist protection and obtain a new, valid token through the refresh endpoint. With a CVSS score of 9.1 (CRITICAL), this vulnerability has a low attack complexity and can lead to high impact on confidentiality and integrity, as it allows unauthorized access to resources. There is no evidence of active exploitation, and no public exploit code is available, though it has garnered significant community discussion with 10 mentions.