CVE-2021-21416: Potential sensitive information disclosure in django-registration
Summary
CVE-2021-21416: Potential sensitive information disclosed in error reports. Affects django-registration versions < 3.1.2. Fixed in 3.1.2. How to fix ↓
Also tracked for
- python-django-registration · Debian:11
The same CVE-2021-21416 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
django-registration is a user-registration application for Django. It provides tools for implementing user-account registration flows in the Django web framework.
Vulnerability Detail
The django-registration package prior to version 3.1.2 does not properly filter sensitive data in error reports. When a server-side error occurs during user account registration, detailed error reports may include sensitive information such as proposed credentials (e.g., password). This vulnerability can be triggered if the site is using django-registration < 3.1.2, has detailed error reports enabled, and experiences a server-side error during account registration.
How To Fix
Latest published version: 5.2.1 as of 22 Oct 2026
pip install --upgrade "django-registration==5.2.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.2
This is the first release that contains the fix.
pip install --upgrade "django-registration==3.1.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading immediately is not possible, users can apply the django.views.decorators.debug.sensitive_post_parameters() decorator to their own registration views. The decorator should be applied on the dispatch() method of the appropriate RegistrationView class using Django's method_decorator() helper. Here's an example:
from django.utils.decorators import method_decorator
from django.views.decorators.debug import sensitive_post_parameters
from django_registration.views import RegistrationView
class MyRegistrationView(RegistrationView):
@method_decorator(sensitive_post_parameters())
def dispatch(self, *args, **kwargs):
return super().dispatch(*args, **kwargs)
Conclusion
The vulnerability in django-registration prior to version 3.1.2 can lead to potential sensitive information disclosure in error reports. It is recommended to upgrade to the latest version or apply the provided workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for django-registration →
FAQ
django-registration is a user-registration application for Django that provides tools for implementing user-account registration flows.
The vulnerability allows sensitive data, such as proposed credentials, to be included in error reports, potentially exposing user information.
Upgrade to django-registration version 3.1.2 or later, which applies the necessary filters to prevent sensitive data disclosure.
If immediate upgrade is not possible, users can manually apply the sensitive_post_parameters() decorator to their own registration views.
You can refer to Django's documentation on error reporting in production for more details.
