VDB
CISA-2025-13473
CISA-2025-13473
PUBLISHED
CVSS 5.3 MEDIUM
Reported by DSF · Published February 3, 2026
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.
Risk Scores
CVSS 3.1
5.3
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| djangoproject | Django | 6.0, 6.0.2, 5.2 |
| djangoproject | Django | 6.0.2, 5.2, 5.2.11 |
Timeline
- Feb 3, 2026 CVE Published
- Feb 3, 2026 CVE Updated
References
- Django security archive vendor-advisory
- Django releases announcements mailing-list
- Django security releases issued: 6.0.2, 5.2.11, and 4.2.28 vendor-advisory