Django Software Foundation · Django · CVE-2019-19844
**Name of the Vulnerable Software and Affected Versions**
Django versions prior to 1.11.27
Django versions 2.x prior to 2.2.9
Django versions 3.x prior to 3.0.1
**Description**
The issue allows account takeover by sending a password reset token to an attacker for a matched user account. This occurs when a suitably crafted email address, equal to an existing user's email address after case transformation of Unicode characters, is used. The new releases mitigate this by sending password reset tokens only to the registered user email address.
**Recommendations**
For Django versions prior to 1.11.27, update to version 1.11.27 or later.
For Django versions 2.x prior to 2.2.9, update to version 2.2.9 or later.
For Django versions 3.x prior to 3.0.1, update to version 3.0.1 or later.
As a temporary workaround, consider restricting password reset functionality to minimize the risk of exploitation.