CVE-2025-13473

Description

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

CVSS Metrics

• v4.0•MEDIUM•Score: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
• v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 0.74%• Percentile: 53%

Techniques & Countermeasures

• CWE-208•Observable Timing Discrepancy

  Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Affected Systems

• chainguard•authentik

  < 2025.12.1-r2

• chainguard•authentik-fips

  < 2025.12.1-r2

• chainguard•awx

  < 24.6.1-r27

• chainguard•label-studio

  < 1.22.0-r3

• debian•python-django

  < 2:2.2.28-1~deb11u12 | < 3:3.2.25-0+deb12u2 | < 3:4.2.28-0+deb13u1 | < 3:4.2.28-1

• djangoproject•django

  ≥ 4.2, < 4.2.28 | ≥ 5.2, < 5.2.11 | ≥ 6.0, < 6.0.2

• PyPI•django

  ≥ 6.0, < 6.0.2 | ≥ 6.0a1, < 6.0.2 | ≥ 5.2a1, < 5.2.11 | ≥ 4.2a1, < 4.2.28

References (13)

• https://docs.djangoproject.com/en/dev/releases/security/
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
• https://nvd.nist.gov/vuln/detail/CVE-2025-13473
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://www.djangoproject.com/weblog/2026/feb/03/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-42.yaml
• https://github.com/advisories/GHSA-2mcm-79hx-8fxw
• https://security-tracker.debian.org/tracker/CVE-2025-13473
• https://github.com/django/django/
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13473.json
• https://pypi.org/project/Django/