CVE-2020-15105: 
Python vulnerability analysis and mitigation

Django Two-Factor Authentication before version 1.12 contains a security vulnerability where user passwords are stored in clear text (base64-encoded) in the user session. The vulnerability was discovered and disclosed on July 10, 2020. The issue affects all versions prior to 1.12 of the django-two-factor-auth package (GitHub Advisory, NVD).

The vulnerability occurs when a user submits their username and password during the two-factor authentication process. The password is stored in the session until the user completes authentication by entering a two-factor code. If the user abandons the login process after entering their password but before completing 2FA, the password remains stored indefinitely. The password is stored in base64-encoded format, which is essentially plaintext as it can be easily decoded (GitHub Advisory).

The severity of the impact varies depending on the configured session storage type. In the worst case, using Django's default database session storage results in passwords being stored in clear text in the database. With Django's signed cookie session storage, passwords are stored in clear text in the browser's cookie store. When using cache session storage (typically Memcached or Redis), passwords are stored in clear text in the cache storage (GitHub Advisory).

The vulnerability requires no special exploitation techniques, as the passwords are stored in an easily accessible and readable format. Organizations using affected versions who have experienced a database breach should consider all stored passwords compromised (GitHub Advisory).

The primary mitigation is to upgrade to version 1.12 or later. After upgrading, organizations should delete any stored clear text passwords from their session storage, including database records and backups. Users whose passwords may have been exposed should be notified and advised to change their passwords. A partial workaround involves switching to Django's signed cookie session storage, though this should be carefully evaluated due to security tradeoffs (GitHub Advisory).