---
id: CVE-2020-5224
aliases:
  - GHSA-5fq8-3q2f-4m5g
  - PYSEC-2020-230
title: Session key exposure through session list in Django User Sessions
summary: Session key exposure through session list in Django User Sessions
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N'
vendor: django-user-sessions
product: django-user-sessions
ecosystem: pip
affected:
  - django-user-sessions < 1.7.1
patched:
  - django-user-sessions 1.7.1
published: '2020-01-24'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-5fq8-3q2f-4m5g'
references:
  - url: >-
      https://github.com/Bouke/django-user-sessions/security/advisories/GHSA-5fq8-3q2f-4m5g
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-5224'
  - url: >-
      https://github.com/jazzband/django-user-sessions/commit/f0c4077e7d1436ba6d721af85cee89222ca5d2d9
  - url: 'https://github.com/Bouke/django-user-sessions'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/django-user-sessions/PYSEC-2020-230.yaml
tags:
  - osv
  - pip
epss: 0.00527
epssPercentile: 0.43612
ingestedAt: '2026-07-08T18:25:45.990Z'
---

## Overview

### Impact
The views provided by django-user-sessions allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the session key could be extracted by the attacker and a session takeover could happen.

### Patches
Patch is under way.

### Workarounds
Remove the session_key from the template.

### References
_None._

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Bouke/django-user-sessions](https://github.com/Bouke/django-user-sessions/issues)
* Email us at [bouke@haarsma.eu](mailto:bouke@haarsma.eu)

## Affected packages

- `django-user-sessions < 1.7.1`

## Remediation

Upgrade to a patched release:

- `django-user-sessions 1.7.1`