Weblate Long Session Expiry Vulnerability in Two-Factor Authentication

A vulnerability exists in Weblate versions prior to 5.13.1, where the session expiry during second-factor verification is excessively long. This prolonged expiry can be exploited to bypass rate limiting on the second factor, potentially leading to abuse of the authentication process.

Impact

The extended session expiry during two-factor authentication verification can be exploited to circumvent rate limiting, allowing for repeated authentication attempts without delay.

Remediation

Users can upgrade to Weblate version 5.13.1 to address this vulnerability. Instructions for updating can be found in the Weblate documentation.