Insecure API Key Configuration in wlc Package
Summary
GHSA-9rp8-h4g8-8766: Weblate wlc has insecure API key configuration. Affects wlc versions < 1.17.0. Fixed in 1.17.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wlc package, part of the Weblate project, is designed to facilitate translation management by providing a web-based interface for collaborative translation. It allows users to manage translation files and collaborate on translations in real-time. However, it has been found to have a vulnerability related to the handling of API keys, which can lead to unauthorized access if not properly configured.
Vulnerability Detail
The vulnerability arises from the historical support for unscoped API keys in the wlc configuration settings. Although this practice has been discouraged for years, the code allowing it was never removed. As a result, an unscoped API key could potentially be used against different servers, leading to unauthorized access and data breaches. This issue is classified under CWE-922, which pertains to the improper restriction of operations within the bounds of a memory buffer.
How To Fix
Latest published version: 3.1.0 as of 23 Oct 2026
pip install --upgrade "wlc==3.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.17.0
This is the first release that contains the fix.
pip install --upgrade "wlc==1.17.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, remove any unscoped key from the wlc configuration. Ensure that only URL-scoped keys are used in the [keys] sections of the configuration file. This can be done by editing the configuration file and ensuring it looks like this:
[keys] url_scoped_key = 'your_url_scoped_key_here'
Conclusion
The wlc package has a vulnerability related to insecure API key configuration, which can lead to unauthorized access if unscoped keys are used. It is crucial to update to the latest version and follow the recommended workarounds to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for wlc →
FAQ
An unscoped API key is a key that does not have restrictions on which server or resource it can access, potentially allowing unauthorized access.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities.
Using unscoped API keys can lead to unauthorized access to your application, data breaches, and potential misuse of your services.
Yes, the vulnerability has been patched in version 1.17.0 of the wlc package. It is recommended to update to this version or later.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for wlc.
