CVE-2024-39329

score

<0.1

cvss

5.3

epss

0.9%

published

2024-07-10

kev added

—

first seen

2026-10-21

Django 5.0 < 5.0.7 and 4.2 < 4.2.14 contain a user enumeration vulnerability caused by timing attack in django.contrib.auth.backends.ModelBackend.authenticate(), letting remote attackers identify valid users via login timing, exploit requires sending login requests.