PT-2025-36103 · Weblate · Weblate

Nahid Hasan Limon · Published 2025-09-04 · Updated 2025-09-05 · CVE-2025-58352

Positive Technologies · (AI Summary)

CVSS v4.0

2.1

2.1

Low

Base vector

AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions:

Weblate versions prior to 5.13.1

Description:

Weblate is a web-based localization tool. Versions prior to 5.13.1 are susceptible to a second factor authentication bypass due to a long session expiry during the second factor verification process. This long session expiry could be used to circumvent rate limiting of the second factor.

Recommendations:

Update to Weblate version 5.13.1 or later.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2025-58352

Affected Products

Weblate

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-58352 · Security Note
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-377j-wj38-4728 · Note
• https://github.com/WeblateOrg/weblate/pull/16002 · Note
• https://github.com/WeblateOrg/weblate/commit/0b46fe596231dd456283ead66699ae5516f23908 · Note
• https://twitter.com/CVEnew/status/1963827261104361604 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1963771434376806865 · Twitter Post