---
id: CVE-2024-22513
aliases:
  - GHSA-5vcc-86wm-547q
  - PYSEC-2026-1305
title: Improper Privilege Management in djangorestframework-simplejwt
summary: Improper Privilege Management in djangorestframework-simplejwt
severity: low
vendor: djangorestframework-simplejwt
product: djangorestframework-simplejwt
ecosystem: pip
affected:
  - djangorestframework-simplejwt < 5.5.1
patched:
  - djangorestframework-simplejwt 5.5.1
published: '2024-03-16'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-5vcc-86wm-547q'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-22513'
  - url: 'https://github.com/jazzband/djangorestframework-simplejwt/issues/779'
  - url: 'https://github.com/jazzband/djangorestframework-simplejwt/pull/872'
  - url: 'https://github.com/jazzband/djangorestframework-simplejwt/pull/873'
  - url: 'https://github.com/jazzband/djangorestframework-simplejwt/pull/891'
  - url: >-
      https://github.com/jazzband/djangorestframework-simplejwt/commit/14e8b2cf5fa0df954af82ff3926fa6d6c4ecf13e
  - url: >-
      https://github.com/jazzband/djangorestframework-simplejwt/commit/1ad763bfe73936515aa4756263338c63866364c9
  - url: >-
      https://github.com/jazzband/djangorestframework-simplejwt/commit/a2d0a0201b6123536ecf76cd4d0ec7389317d0a7
  - url: 'https://github.com/dmdhrumilmistry/CVEs/tree/main/CVE-2024-22513'
  - url: 'https://github.com/jazzband/djangorestframework-simplejwt'
  - url: >-
      https://github.com/jazzband/djangorestframework-simplejwt/blob/c791e987332ed5e22a86428160d6372b1d85ffae/rest_framework_simplejwt/tokens.py#L281
tags:
  - osv
  - pip
  - exploit-available
epss: 0.00804
epssPercentile: 0.54892
exploitAvailable: true
ingestedAt: '2026-07-08T18:25:46.210Z'
exploits:
  exploitdb: true
  checkedAt: '2026-09-26T09:05:30.940Z'
---

## Overview

djangorestframework-simplejwt before version 5.5.1 is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method.

## Affected packages

- `djangorestframework-simplejwt < 5.5.1`

## Remediation

Upgrade to a patched release:

- `djangorestframework-simplejwt 5.5.1`