GitHub Advisoryadvisory · PyPI
GHSA-57jg-m997-cx3q Weblate lacks rate limiting when verifying second factor
MEDIUM
Official page ↗
- Aliases
- CVE-2025-47951
- Ecosystem
- PyPI
- Packages
- weblate
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-307
- Reviewed
- 2025-06-16
Affected packages
• PyPI weblate: < 5.12 → fixed in 5.12
Description
Impact
The verification of the second factor was not subject to rate limiting. The absence of rate limiting on the second factor endpoint allows an attacker with valid credentials to automate OTP guessing.
Patches
This issue has been addressed in Weblate 5.12 via https://github.com/WeblateOrg/weblate/pull/14918.
References
Thanks to obscuredeer for reporting this issue at HackerOne.
Related
Alias · CVE (1)
- CVE-2025-47951 Weblate is a web based localization tool. vulnerability
Weakness · CWE (1)
- CWE-307 Improper Restriction of Excessive Authentication Attempts weakness
References
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-57jg-m997-cx3q web
- https://nvd.nist.gov/vuln/detail/CVE-2025-47951 advisory
- https://github.com/WeblateOrg/weblate/pull/14918 web
- https://github.com/WeblateOrg/weblate/commit/f806293451248c5d95e45b3b507e9d158bc4f384 web
- https://hackerone.com/reports/3150564 web
- https://github.com/WeblateOrg/weblate package
- https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.12.1 web