GitHub Advisoryadvisory · PyPI
GHSA-6j8j-4qp3-36p2 Weblate Doesn't Invalidate API Token on Password Change
MEDIUM
Official page ↗
- Aliases
- CVE-2026-41519
- Ecosystem
- PyPI
- Packages
- weblate
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-613
- Reviewed
- 2026-04-30
Affected packages
• PyPI weblate: < 5.17.1 → fixed in 5.17.1
Description
Impact
When a user changes their password, browser sessions are correctly invalidated via `cycle_session_keys()`, but DRF API tokens (`wlu_*` prefix) stored in `authtoken_token` are not revoked.
Patches
• https://github.com/WeblateOrg/weblate/pull/19057
Resources
Weblate thanks Sang Yu Jeon for reporting this via GitHub.
Related
Weakness · not in database (1)
Alias · CVE (1)
- CVE-2026-41519 Weblate is a web based localization tool. vulnerability
References
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6j8j-4qp3-36p2 web
- https://nvd.nist.gov/vuln/detail/CVE-2026-41519 advisory
- https://github.com/WeblateOrg/weblate/pull/19057 web
- https://github.com/WeblateOrg/weblate/commit/649a2da81700542f95c0807b3c625fc3bb0eaf95 web
- https://github.com/WeblateOrg/weblate package
- https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1 web