CVE-2026-41519: Weblate's API Token Not Invalidated on Password Change
Impact When a user changes their password, browser sessions are correctly invalidated via cyclesessionkeys(), but DRF API tokens (wlu prefix) stored in authtokentoken are not revoked.
Patches https://github.com/WeblateOrg/weblate/pull/19057
Resources Weblate thanks Sang Yu Jeon for reporting this via GitHub.
Other sources
Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions are correctly invalidated via "cyclesessionkeys()", but DRF API tokens ("wlu" prefix) stored in "authtokentoken" are not revoked. This issue has been patched in version 5.17.1.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41519?
CVE-2026-41519 has a moderate severity level due to the risk of unauthorized access with persistent tokens after a user password change.
How do I fix CVE-2026-41519?
To fix CVE-2026-41519, upgrade to Weblate version 5.17.1 or later which includes the necessary patch for token revocation.
What are the potential risks of CVE-2026-41519?
The risks of CVE-2026-41519 include the potential for attackers to utilize old API tokens which were not revoked after a password change.
Which versions of Weblate are affected by CVE-2026-41519?
CVE-2026-41519 affects Weblate versions prior to 5.17.1, where DRF API tokens are not revoked upon password changes.
What should I do if I cannot update to the fixed version for CVE-2026-41519?
If you're unable to update Weblate for CVE-2026-41519, manually revoke all active API tokens after a user password change to mitigate risks.