CVE-2025-58352: Weblate has a long session expiry when verifying second factor

September 4, 2025 (updated November 10, 2025)

The verification of the second factor had too long a session expiry. The long session expiry could be used to circumvent rate limiting of the second factor.

References

github.com/WeblateOrg/weblate
github.com/WeblateOrg/weblate/commit/0b46fe596231dd456283ead66699ae5516f23908
github.com/WeblateOrg/weblate/pull/16002
github.com/WeblateOrg/weblate/security/advisories/GHSA-377j-wj38-4728
github.com/advisories/GHSA-377j-wj38-4728
nvd.nist.gov/vuln/detail/CVE-2025-58352

Code Behaviors & Features

Detect and mitigate CVE-2025-58352 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →