CVE-2025-58352

Weblate is a web based localization tool. Versions lower than 5.13.1 contain a vulnerability that causes long session expiry during the second factor verification. The long session expiry could be used to circumvent rate limiting of the second factor. This issue is fixed in version 5.13.1.

CVSS 4.0

2.1CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

EPSS

0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-25)

CWE

CWE-613

Published

2025-09-05

Modified

2026-09-30

Record from

the NVD, synced 2026-10-19

Affected

• weblate:weblate

Packages (OSV)

References

• https://github.com/WeblateOrg/weblate/commit/0b46fe596231dd456283ead66699ae5516f23908
• https://github.com/WeblateOrg/weblate/pull/16002
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-377j-wj38-4728

Check your stackJSON