4.9

CVE-2025-47951

Weblate lacks rate limiting when verifying second factor

Weblate is a web based localization tool. Prior to version 5.12, the verification of the second factor was not subject to rate limiting. The absence of rate limiting on the second factor endpoint allows an attacker with valid credentials to automate OTP guessing. This issue has been patched in version 5.12.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Weblate ≫ Weblate Version < 5.12
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.22% 0.119
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 4.9 1.8 2.7
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE-307 Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

https://github.com/WeblateOrg/weblate/security/advisories/GHSA-57jg-m997-cx3q
Vendor Advisory
https://github.com/WeblateOrg/weblate/pull/14918
Issue Tracking
https://github.com/WeblateOrg/weblate/commit/f806293451248c5d95e45b3b507e9d158bc4f384
Patch
https://hackerone.com/reports/3150564
Permissions Required
https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.12.1
Release Notes