CVE-2025-58352: Weblate Authentication Bypass Vulnerability

CVE-2025-58352 Overview

Weblate is a web-based localization platform used to manage translations for open source and commercial projects. Versions prior to 5.13.1 apply a long session expiry during second factor authentication (2FA) verification. The extended session lifetime allows an attacker to circumvent rate limiting that protects the 2FA challenge. The issue is classified under CWE-613 (Insufficient Session Expiration) and is fixed in Weblate 5.13.1.

Critical Impact
An authenticated attacker with valid primary credentials can extend the 2FA verification window and defeat rate limiting, increasing the chance of guessing a valid one-time code.

Affected Products

Weblate versions prior to 5.13.1
Self-hosted Weblate deployments using default session configuration
Weblate instances with 2FA enabled for user accounts

Discovery Timeline

2025-09-05 - CVE-2025-58352 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58352

Vulnerability Analysis

Weblate uses Django's session framework to track authenticated users. Before version 5.13.1, sessions in the intermediate 2FA verification state inherited the standard session cookie age. That value is intended for fully authenticated users and is typically measured in weeks. Because the session persisted across long intervals, an attacker who obtained a username and password could return to the same 2FA challenge repeatedly without triggering session-level timeouts.

Rate limiting on the second factor input relied on this session boundary. A long-lived pre-2FA session gives an attacker a larger effective window to submit one-time codes or push notifications. The result reduces the entropy protection that 2FA is designed to provide.

Root Cause

The root cause is missing separation between the session lifetime used for unauthenticated users and the lifetime used for users pending 2FA verification. Weblate did not previously expose a distinct expiry setting for the 2FA-pending state, so the general SESSION_COOKIE_AGE value applied.

Attack Vector

Exploitation requires network access to the Weblate instance, valid primary credentials for a target account, and user interaction elements consistent with the CVSS vector. The attacker submits the primary login, then repeatedly attempts second factor codes across the extended session window to bypass rate limits.

text

# Patch excerpt: docs/admin/config.rst (Weblate 5.13.1)

.. setting:: SESSION_COOKIE_AGE_2FA

SESSION_COOKIE_AGE_2FA
----------------------

.. versionadded:: 5.13.1

Set session expiry while in :ref:`2fa`. This complements
:setting:`django:SESSION_COOKIE_AGE` which is used for unauthenticated users.

Source: WeblateOrg/weblate commit 0b46fe5

Detection Methods for CVE-2025-58352

Indicators of Compromise

Repeated failed 2FA submissions from the same session cookie or client IP against a single Weblate account.
Prolonged pre-authenticated sessions that remain in the 2FA challenge state across hours or days.
Successful 2FA verification following an atypical number of prior invalid attempts.

Detection Strategies

Review Weblate authentication logs for accounts with a high ratio of 2fa failure events to primary login events.
Correlate session identifiers across HTTP access logs to identify sessions that persist without completing 2FA within a short window.
Alert on 2FA verification success events preceded by more than a small threshold of failed attempts on the same session.

Monitoring Recommendations

Ship Weblate application and reverse proxy logs to a centralized SIEM or data lake for correlation.
Track distributions of session lifetimes in the 2FA-pending state and flag outliers.
Monitor changes to SESSION_COOKIE_AGE and the new SESSION_COOKIE_AGE_2FA configuration for unexpected values.

How to Mitigate CVE-2025-58352

Immediate Actions Required

Upgrade all Weblate instances to version 5.13.1 or later.
Set SESSION_COOKIE_AGE_2FA to a short interval consistent with normal user 2FA completion time.
Force logout of active sessions after upgrade so users re-authenticate under the new session policy.
Review recent 2FA activity for accounts that may have been targeted before the patch was applied.

Patch Information

The fix is delivered in Weblate 5.13.1 through the commit that introduces the SESSION_COOKIE_AGE_2FA setting and shortens session expiry during 2FA verification. See the GitHub Security Advisory GHSA-377j-wj38-4728, the upstream commit 0b46fe5, and Pull Request #16002 for implementation details.

Workarounds

If upgrade is not immediately possible, lower SESSION_COOKIE_AGE globally so unauthenticated and 2FA-pending sessions expire quickly.
Enforce stricter reverse-proxy or web application firewall rate limiting on the 2FA verification endpoint.
Restrict Weblate administrative and login endpoints to trusted networks or VPN access until patched.

bash

# Configuration example (Weblate settings.py after upgrade to 5.13.1)
# Short lifetime for sessions pending 2FA verification (seconds)
SESSION_COOKIE_AGE_2FA = 300

# Baseline session lifetime for unauthenticated users
SESSION_COOKIE_AGE = 600