---
id: CVE-2025-58352
title: Weblate is a web based localization tool
summary: >-
  Weblate is a web based localization tool. Versions lower than 5.13.1 contain a
  vulnerability that causes long session expiry during the  second factor
  verification. The long session expiry could be used to circumvent rate
  limiting of the…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'
cwe:
  - CWE-613
vendor: weblate
product: weblate
affected:
  - weblate < 5.13.1
patched:
  - weblate 5.13.1
published: '2025-09-05'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T23:10:00.237'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-58352'
references:
  - url: >-
      https://github.com/WeblateOrg/weblate/commit/0b46fe596231dd456283ead66699ae5516f23908
    label: security-advisories@github.com
  - url: 'https://github.com/WeblateOrg/weblate/pull/16002'
    label: security-advisories@github.com
  - url: >-
      https://github.com/WeblateOrg/weblate/security/advisories/GHSA-377j-wj38-4728
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-58352'
  - url: 'https://github.com/WeblateOrg/weblate'
tags:
  - nvd
  - osv
  - pip
epss: 0.0029
epssPercentile: 0.21412
aliases:
  - GHSA-377j-wj38-4728
  - PYSEC-2026-2036
ecosystem: pip
ingestedAt: '2026-07-08T18:25:44.860Z'
---

## Overview

Weblate is a web based localization tool. Versions lower than 5.13.1 contain a vulnerability that causes long session expiry during the  second factor verification. The long session expiry could be used to circumvent rate limiting of the second factor. This issue is fixed in version 5.13.1.

## Affected

- `weblate < 5.13.1`

## Remediation

Upgrade past the affected range:

- `weblate 5.13.1`

## Package advisory (CVE-2025-58352)

Affected packages:

- `weblate < 5.13.1`

Patched in:

- `weblate 5.13.1`

Source: https://osv.dev/vulnerability/GHSA-377j-wj38-4728