CVE-2019-13177: Improper Verification of Cryptographic Signature in django-rest-registration
Summary
CVE-2019-13177: Improper Verification of Cryptographic Signature in django-rest-registration. Affects django-rest-registration versions >= 0.2.0, < 0.5.0. Fixed in 0.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The django-rest-registration package is a Django library that provides user registration and authentication functionality for REST APIs. It includes features such as email verification and password reset. This vulnerability affects versions 0.2.* - 0.4.* of the library. The package is vulnerable to a misusing of the Django Signer API, which leads to predictable signatures used in verification emails.
Vulnerability Detail
The vulnerability allows an attacker to take over any Django user by resetting their password without receiving the reset password verification link. This can be done by guessing the signature from publicly available data. The issue arises from the misuse of the Django Signer API, where the salt is passed wrongly as the secret key, replacing the actual SECRET_KEY set in the Django settings file. As a result, the secret key of the signer becomes the salt, which is often a static string publicly available. This allows an attacker to easily guess the signature contained in the verification link sent in a verification email.
How To Fix
Latest published version: 0.9.0 as of 22 Oct 2026
pip install --upgrade "django-rest-registration==0.9.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.0
This is the first release that contains the fix.
pip install --upgrade "django-rest-registration==0.5.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not possible, there are a couple of workarounds. One option is to disable the verification options by using minimal configuration, which unfortunately disables checking the validity of the given email. Another option is to temporarily disable the reset password functionality by setting 'RESET_PASSWORD_VERIFICATION_ENABLED' to False in the Django settings. This will prevent the worst-case scenario of account takeover by an attacker.
Conclusion
The django-rest-registration package is vulnerable to an improper verification of cryptographic signature issue, which allows an attacker to take over user accounts. It is crucial to upgrade to version 0.5.0 or higher to fix the vulnerability. If upgrading is not possible, workarounds are available to disable the verification options or temporarily disable the reset password functionality. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for django-rest-registration →
FAQ
Versions 0.2., 0.3., and 0.4.* of django-rest-registration are affected. Version 0.1.* is not affected.
The vulnerability allows an attacker to take over any Django user by resetting their password without receiving the reset password verification link. This can lead to unauthorized access to user accounts.
To fix the vulnerability, upgrade to version 0.5.0 or higher of django-rest-registration. This will patch the issue and invalidate previously generated signatures and verification links.
Yes, if upgrading is not possible, you can disable the verification options or temporarily disable the reset password functionality as mentioned in the workaround section.
If you have already set 'RESET_PASSWORD_VERIFICATION_ONE_TIME_USE' to True in the Django settings, it can mitigate the security issue to some extent. However, upgrading to the latest version is still highly recommended.
References
Related vulnerabilities
Recent vulnerabilities recorded for django-rest-registration.
