User Enumeration Vulnerability in Django: Observable Timing Discrepancy
Summary
GHSA-2mcm-79hx-8fxw: Django has Observable Timing Discrepancy. Affects django across 3 version ranges.
>= 4.2a1, < 4.2.28
>= 5.2a1, < 5.2.11
>= 6.0a1, < 6.0.2
Fixed in 4.2.28, 5.2.11 or 6.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an authentication system. However, certain versions of Django are susceptible to a timing attack that can allow remote attackers to enumerate valid usernames, compromising the security of applications that rely on this framework.
Vulnerability Detail
An issue was discovered in Django versions 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The vulnerability resides in the django.contrib.auth.handlers.modwsgi.check_password() function, which is used for authentication via mod_wsgi. This flaw allows attackers to exploit timing discrepancies in the password checking process, enabling them to determine valid usernames through a series of crafted authentication requests. This could lead to unauthorized access and further exploitation of the application.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2a1, < 4.2.284.2.28pip install --upgrade "django==4.2.28" -
>= 5.2a1, < 5.2.115.2.11pip install --upgrade "django==5.2.11" -
>= 6.0a1, < 6.0.26.0.2pip install --upgrade "django==6.0.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider implementing rate limiting on authentication attempts to mitigate the risk of timing attacks. This can help reduce the effectiveness of user enumeration attempts.
Conclusion
In summary, the observable timing discrepancy vulnerability in Django can allow attackers to enumerate valid usernames, posing a security risk to applications. It is crucial to update to the latest patched versions to mitigate this risk. Additionally, implementing rate limiting can serve as a temporary workaround while updates are applied.
See every vulnerability recorded for django →
FAQ
A timing attack is a type of side-channel attack where an attacker attempts to compromise a system by analyzing the time it takes to execute cryptographic algorithms or processes.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities. Visit Vulert Scanner to analyze your application without needing to sign up.
Django versions 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28 are known to be vulnerable. Unsupported versions such as 5.0.x, 4.1.x, and 3.2.x may also be affected.
If exploited, this vulnerability can lead to user enumeration, allowing attackers to identify valid usernames and potentially gain unauthorized access to user accounts.
The CVSS score for this vulnerability is 2.7, indicating a low severity level, but it still poses a risk to applications that rely on Django for user authentication.
Related vulnerabilities
Recent vulnerabilities recorded for django.
