Executive brief
Weblate is a collaborative translation management platform. During the two-factor authentication verification process, Weblate maintains user sessions with an excessively long expiry time. This weakness allows attackers to bypass rate limiting protections on second factor attempts, potentially enabling brute-force attacks to compromise accounts that have two-factor authentication enabled.
Technical details
The vulnerability stems from improper session management during the second factor verification flow (CWE-613). When a user initiates two-factor authentication, the session timeout is set to an overly long duration, which attackers can exploit to circumvent rate limiting protections on authentication attempts. The attack vector is network-based and requires initial authentication (low privilege) plus user interaction (passive). An attacker can leverage this to perform brute-force attacks against two-factor codes without being rate-limited. The vulnerability affects Weblate versions prior to 5.13.1, which addressed the issue via pull request #16002 by reducing the session expiry time during second factor verification.
Affected products
- Weblate Weblate all versions before 5.13.1
Timeline
- 2025-09-04: disclosed: Advisory published
- 2025-09-04: patched: Fixed in version 5.13.1