Hard-Coded Cryptographic Key in DjangoBlog Amap API Handler

Publication date: 2026-04-19

Last updated on: 2026-04-29

Assigner: VulDB

Description

A security vulnerability has been detected in liangliangyy DjangoBlog up to 2.1.0.0. Affected is an unknown function of the file owntracks/views.py of the component Amap API Call Handler. Such manipulation of the argument key leads to use of hard-coded cryptographic key . The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-19

Last Modified

2026-04-29

Generated

2026-07-06

AI Q&A

2026-04-20

EPSS Evaluated

2026-07-04

NVD

CVE-2026-6580

EUVD

EUVD-2026-23714

Affected Vendors & Products

Vendor	Product	Version / Range
liangliangyy	django_blog	to 2.1.0.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-320	Key Management Errors
CWE-321	The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the liangliangyy DjangoBlog software up to version 2.1.0.0, specifically in the Amap API Call Handler component within the file owntracks/views.py. It involves manipulation of an argument named 'key' which causes the software to use a hard-coded cryptographic key. This flaw can be exploited remotely.

Impact Analysis

The use of a hard-coded cryptographic key due to this vulnerability can lead to compromised security, as attackers may exploit this to bypass authentication or decrypt sensitive data. Since the attack can be launched remotely, it increases the risk of unauthorized access or data manipulation.

Hi! I’m here to help you understand CVE-2026-6580. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70