Executive brief
django-nopassword is a Django authentication library that enables passwordless login via authentication codes sent to users. Prior to version 5.0.0, the library stored these login codes in plaintext in the database, allowing attackers with database access to obtain valid authentication codes and impersonate users without knowing their password.
Technical details
django-nopassword stores authentication codes in the database without encryption or hashing (CWE-312, CWE-522). The vulnerability affects all versions before 5.0.0. An attacker with access to the database (either through SQL injection, stolen backups, or direct database compromise) can read plaintext authentication codes and use them to log in as any user. The fix in version 5.0.0 implements hashing and comparison of login codes instead of storing them in cleartext. No authentication is required to exploit this—only database access is needed.
Affected products
- django-nopassword contributors django-nopassword 0.0.0 through 4.0.2
Timeline
- 2020-03-18: disclosed: NVD published
- 2020-06-05: advisory: GHSA advisory published
- 2019-04-06: patched: Fix committed; released in version 5.0.0