CVE-2025-58352: Weblate Long Session Expiry in Second Factor Verification
Summary
CVE-2025-58352: Weblate has a long session expiry when verifying second factor. Affects weblate versions < 5.13.1. Fixed in 5.13.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Weblate is an open-source web-based translation management system that facilitates collaborative translation efforts. It allows users to manage translation projects efficiently, providing features such as version control, translation memory, and integration with various version control systems. However, a vulnerability has been identified in its second factor verification process, which could potentially compromise the security of user sessions.
Vulnerability Detail
The vulnerability arises from an excessively long session expiry during the verification of the second factor in Weblate. This extended session expiry can be exploited to bypass rate limiting mechanisms, allowing an attacker to attempt multiple second factor verifications without being restricted by time. This could lead to unauthorized access to user accounts if an attacker is able to guess or intercept the second factor.
How To Fix
Latest published version: 2026.10.1 as of 22 Oct 2026
pip install --upgrade "weblate==2026.10.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.13.1
This is the first release that contains the fix.
pip install --upgrade "weblate==5.13.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement stricter rate limiting on second factor verification attempts at your application level until you can upgrade to the patched version. This can be done by limiting the number of attempts allowed within a specific timeframe.
Conclusion
The vulnerability identified as CVE-2025-58352 in Weblate poses a significant security risk due to its long session expiry during second factor verification. It is crucial for users to upgrade to version 5.13.1 or later to mitigate this risk and ensure the security of their accounts.
See every vulnerability recorded for weblate →
FAQ
The vulnerability involves a long session expiry during the second factor verification process, which can be exploited to bypass rate limiting.
If you are using a version of Weblate prior to 5.13.1, your installation is affected by this vulnerability.
An attacker could exploit this vulnerability to gain unauthorized access to user accounts by circumventing rate limiting on second factor verifications.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground.
Implement stricter rate limiting on second factor verification attempts as a temporary workaround until you can upgrade to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for weblate.
