CVE-2025-13473Djangoproject Django
NVDCVSS scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Vulnerability Summary
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Stackered for reporting this issue.
The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Stackered for reporting this issue.
CVSS v3.1 Base Metrics — Score 5.3 (MEDIUM)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NAttack VectorNetwork
Attack ComplexityHigh
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone
Affected & Patched Versions
- Djangoproject Django >= 4.2 and < 4.2.28
- Djangoproject Django >= 5.2 and < 5.2.11
- Djangoproject Django >= 6.0 and < 6.0.2
- Djangoproject Django 4.2.28
- Djangoproject Django 5.2.11
- Djangoproject Django 6.0.2
What to do
Fix it during your normal patch cycle. No exploitation is confirmed yet.
- Check whether you run Djangoproject Django and which version.
- Update to a patched version listed above, then confirm the new version.
Timeline
- Feb 3, 2026Published
- Feb 4, 2026Record last modified
Score, severity and exploitation changes are tracked from the day Watchtower started logging them.
Get notified about new Djangoproject Django CVEsYou are reading CVE-2025-13473. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alertsExternal References
Data last checked: Nov 15, 2026 03:31 UTC