GHSA-57jg-m997-cx3q

Weblate lacks rate limiting when verifying second factor

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-47951

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	weblate	< 5.12	5.12

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The verification of the second factor was not subject to rate limiting. The absence of rate limiting on the second factor endpoint allows an attacker with valid credentials to automate OTP guessing. ### Patches This issue has been addressed in Weblate 5.12 via https://github.com/WeblateOrg/weblate/pull/14918. ### References Thanks to [obscuredeer](https://hackerone.com/obscuredeer) for reporting this [issue at HackerOne](https://hackerone.com/reports/3150564).

References

External links from the advisory. They lead to third-party sites.

https://github.com/WeblateOrg/weblate/security/advisories/GHSA-57jg-m997-cx3q web
https://nvd.nist.gov/vuln/detail/CVE-2025-47951 advisory
https://github.com/WeblateOrg/weblate/pull/14918 web
https://github.com/WeblateOrg/weblate/commit/f806293451248c5d95e45b3b507e9d158bc4f384 web
https://hackerone.com/reports/3150564 web
https://github.com/WeblateOrg/weblate package
https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.12.1 web