CVE-2025-13473

score

<0.1

cvss

5.3

epss

0.8%

published

2026-02-03

kev added

—

first seen

2026-10-21

Django < 6.0.2, < 5.2.11, and < 4.2.28 contain a user enumeration vulnerability caused by timing attack in django.contrib.auth.handlers.modwsgi.check_password() during mod_wsgi authentication, letting remote attackers enumerate users, exploit requires network access.