Weblate Second Factor Authentication Rate Limiting Vulnerability

A vulnerability in Weblate prior to version 5.12 allows an attacker with valid credentials to automate one-time password (OTP) guessing. This issue arises from the lack of rate limiting on the second factor authentication endpoint, enabling the rapid submission of OTPs. The vulnerability has been patched in version 5.12.

Impact

Exploitation of this vulnerability could lead to unauthorized access by allowing an attacker to bypass two-factor authentication through automated OTP guessing.

Remediation

Users can upgrade to Weblate version 5.12 or later to address this vulnerability.