Django OAuth Toolkit Session Expiration Vulnerability in ID Token Handling

A vulnerability in Django OAuth Toolkit version 3.3.0 allows for session expiration issues related to ID token management. The vulnerability arises in the '_load_id_token' function within 'oauth2_provider/oauth2_validators.py', where expired ID tokens can be accepted during logout processes. This issue can be exploited remotely, leading to unintended session terminations.

Impact

Exploitation of this vulnerability can cause premature session expirations by incorrectly validating expired ID tokens during logout processes.

Remediation

To address this vulnerability, it is recommended to configure a finite expiration period for refresh tokens and to disable the acceptance of expired ID tokens during RP-initiated logout processes.