CVE-2025-47951CWE-307

Weblate lacks rate limiting when verifying second factor

Medium · published June 16, 2025

CVSS v3.1
4.9
EPSS
0%
Percentile
17.4
In the wild
Unconfirmed
What it is

Weblate is a web based localization tool. Prior to version 5.12, the verification of the second factor was not subject to rate limiting. The absence of rate limiting on the second factor endpoint allows an attacker with valid credentials to automate OTP guessing. This issue has been patched in version 5.12.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00265 · 17.4th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2025-06-16T20:57Z
EPSS history
Timeline
  • 16 JUN 20:57Z
    Weblate lacks rate limiting when verifying second factor
    cvelistv5