CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentication handler
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
The django.contrib.auth.handlers.modwsgi.checkpassword() function for authentication via modwsgi allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Stackered for reporting this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13473?
CVE-2025-13473 is categorized as a medium severity vulnerability due to its potential for username enumeration.
How do I fix CVE-2025-13473?
To remediate CVE-2025-13473, upgrade to Django versions 6.0.2, 5.2.11, or 4.2.28 or later.
What types of attacks are possible with CVE-2025-13473?
Exploiters can perform username enumeration attacks by analyzing timing differences during the authentication process.
Which versions of Django are affected by CVE-2025-13473?
Django versions prior to 6.0.2, 5.2.11, and 4.2.28 are vulnerable to CVE-2025-13473.
Is CVE-2025-13473 exploitable remotely?
Yes, CVE-2025-13473 is exploitable remotely, allowing attackers to potentially identify valid usernames.