CVE-2026-114137

Affected versions of the Django REST framework package are vulnerable to Detection of Error Condition Without Action due to the `TokenProxy` model silently failing to delete the underlying token row while reporting a successful operation. The `TokenProxy.pk` property returns `user_id` instead of the token's actual primary key (`key`), causing `Model.delete()` to build a `DELETE` query that filters on `key` using the user id value; since no row matches this condition, `delete()` returns `(0, {'authtoken.TokenProxy': 0})` without raising any exception, leaving the token record intact in the `authtoken_token` table. An operator or application that calls `.delete()` on a `TokenProxy` instance to revoke a user's authentication token will receive no indication of failure, while the token remains valid and continues to authenticate requests, resulting in a credential that was believed revoked remaining usable indefinitely by anyone in possession of it.