CVE-2023-43791
CriticalPublished
Label Studio has Hardcoded Django SECRET_KEY that can be Abused to Forge Session Tokens
- Published
- Nov 9, 2023
- Updated
- Sep 3, 2024
- Assigning CNA
- GitHub_M
- Evidence observed
- Aug 28, 2026
Primary CVSS
9.8/ 10Critical
Label Studio has Hardcoded Django SECRET_KEY that can be Abused to Forge Session Tokens
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLow · next 30 days
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Leak vulnerability to impersonate any account on Label Studio. An attacker could exploit these vulnerabilities to escalate their privileges from a low privilege user to a Django Super Administrator user. The vulnerability was found to affect versions before `1.8.2`, where a patch was introduced.
Offensive security research hub aggregating original vulnerability advisories, CVE proof-of-concept exploits, conference talks, and internal tooling from diverse product audits.
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.