CVE-2018-6188: Django AuthenticationForm Data Exposure
Summary
CVE-2018-6188: Django vulnerable to information leakage in AuthenticationForm. Affects django across 2 version ranges.
>= 1.11.8, < 1.11.10
>= 2.0a1, < 2.0.2
Fixed in 1.11.10 or 2.0.2, depending on the release line you run. How to fix ↓
Also tracked for
- py-django · Alpine:v3.10
The same CVE-2018-6188 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that provides a set of tools and libraries for building web applications. It includes the django.contrib.auth module, which handles user authentication and authorization. The AuthenticationForm class in Django versions 2.0 before 2.0.2, and 1.11.8 and 1.11.9, is affected by a vulnerability that allows remote attackers to obtain potentially sensitive information. This vulnerability arises from data exposure in the confirm_login_allowed() method, which can be exploited to determine whether a user account is inactive.
Vulnerability Detail
The vulnerability in Django's AuthenticationForm class allows remote attackers to gain access to potentially sensitive information. By leveraging the data exposure in the confirm_login_allowed() method, an attacker can determine whether a user account is inactive. This information can be used to identify valid user accounts and potentially launch further attacks. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.11.8, < 1.11.101.11.10pip install --upgrade "django==1.11.10" -
>= 2.0a1, < 2.0.22.0.2pip install --upgrade "django==2.0.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to apply the fix by upgrading to the patched versions of Django.
Conclusion
The vulnerability in Django's AuthenticationForm class exposes potentially sensitive information and can be exploited by remote attackers. It is crucial to upgrade to the patched versions of Django (2.0.2 or later for Django 2.0, and 1.11.10 or later for Django 1.11) to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability allows remote attackers to obtain potentially sensitive information, which can be used to identify valid user accounts and potentially launch further attacks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file to the playground and it will alert you in real-time for any open-source vulnerabilities, including this one.
Yes, the fix for this vulnerability is to upgrade Django to version 2.0.2 or later (for Django 2.0) or version 1.11.10 or later (for Django 1.11). These versions contain the necessary patches to address the data exposure issue.
No specific workarounds are provided for this vulnerability. It is recommended to apply the fix by upgrading to the patched versions of Django.
You can find more information about this vulnerability in the GitHub Advisory Database at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-rf4j-j272-fj86/GHSA-rf4j-j272-fj86.json
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
