PT-2025-36103 · Weblate · Weblate

Nahid Hasan Limon · Published 2025-09-04 · Updated 2025-09-05 · CVE-2025-58352

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 5.13.1

Description Weblate is a web-based localization tool. Versions prior to 5.13.1 are susceptible to a second factor authentication bypass due to a long session expiry during the second factor verification process. This long session expiry could be used to circumvent rate limiting of the second factor.

Recommendations Update to Weblate version 5.13.1 or later.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2025-58352

GHSA-377J-WJ38-4728

Affected Products

Weblate

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58352.json · Exploit
• https://github.com/WeblateOrg/weblate/commit/0b46fe596231dd456283ead66699ae5516f23908 · Patch
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-377j-wj38-4728 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58352 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-377j-wj38-4728 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58352 · Security Note
• https://github.com/WeblateOrg/weblate · Note
• https://github.com/WeblateOrg/weblate/pull/16002 · Note
• https://twitter.com/VulmonFeeds/status/1963771434376806865 · Twitter Post
• https://twitter.com/CVEnew/status/1963827261104361604 · Twitter Post
• https://t.me/CVEtracker/31749 · Telegram Post