CVE-2025-58352: Weblate Long Session Expiry Vulnerability
Summary
CVE-2025-58352: Weblate has a long session expiry when verifying second factor. Affects weblate versions < 5.13.1. Fixed in 5.13.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Weblate is an open-source web-based translation management system that facilitates collaborative translation efforts. It allows users to manage translations for various projects, providing features such as translation memory, glossary management, and integration with version control systems. However, a vulnerability has been identified in Weblate related to the session expiry of the second factor verification, which could potentially compromise the security of user accounts.
Vulnerability Detail
The vulnerability arises from an excessively long session expiry time for the second factor verification process in Weblate. This extended session duration can be exploited to bypass rate limiting mechanisms, allowing an attacker to repeatedly attempt to authenticate without being blocked. This could lead to unauthorized access to user accounts if the second factor is not adequately protected.
How To Fix
Latest published version: 2026.10.1 as of 22 Oct 2026
pip install --upgrade "weblate==2026.10.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.13.1
This is the first release that contains the fix.
pip install --upgrade "weblate==5.13.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can manually monitor and limit the number of authentication attempts for the second factor verification until they can update to the patched version.
Conclusion
In summary, CVE-2025-58352 is a significant vulnerability in Weblate that stems from a long session expiry for second factor verification. Users are strongly advised to update to version 5.13.1 to mitigate this risk. Temporary workarounds can be employed, but the best course of action is to apply the patch as soon as possible.
See every vulnerability recorded for weblate →
FAQ
CVE-2025-58352 is a vulnerability in Weblate that involves a long session expiry for second factor verification, potentially allowing attackers to bypass rate limiting.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing manual monitoring of authentication attempts to mitigate the risk until you can upgrade.
If exploited, this vulnerability could allow unauthorized users to gain access to accounts by circumventing the second factor verification process.
More information about Weblate can be found on its official website or GitHub repository, where you can also access documentation and community support.
References
Related vulnerabilities
Recent vulnerabilities recorded for weblate.
