PT-2026-6345 · Pypi · Django

Published 2026-02-03 · Updated 2026-02-03

OSV

CVSS v4.0

2.7

Low

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

The django.contrib.auth.handlers.modwsgi.check password() function for authentication via mod wsgi allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Stackered for reporting this issue.

Fix

Weakness Enumeration

CWE-208

Related Identifiers

GHSA-2MCM-79HX-8FXW

Affected Products

Django

References · 7

• https://osv.dev/vulnerability/GHSA-2mcm-79hx-8fxw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13473 · Security Note
• https://github.com/django/django · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-42.yaml · Note
• https://djangoproject.com/weblog/2026/feb/03/security-releases · Note
• https://groups.google.com/g/django-announce · Note
• https://docs.djangoproject.com/en/dev/releases/security · Note