CVE-2025-13473: 
Django vulnerability analysis and mitigation

CVE-2025-13473 is a user enumeration vulnerability in Django's django.contrib.auth.handlers.modwsgi.check_password() function that allows remote attackers to enumerate valid usernames via a timing attack when authentication is handled through mod_wsgi. It affects Django versions 4.2 before 4.2.28, 5.2 before 5.2.11, and 6.0 before 6.0.2; earlier unsupported series (5.0.x, 4.1.x, 3.2.x) were not formally evaluated but may also be affected. The vulnerability was reported by Stackered and disclosed on February 3, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 2.7 (Low) (GitHub Advisory, Django Security Releases).

The root cause is classified as CWE-208 (Observable Timing Discrepancy): the check_password() function in django.contrib.auth.handlers.modwsgi takes measurably different amounts of time to process authentication requests depending on whether a given username exists in the database. An attacker can exploit this by sending repeated authentication requests with candidate usernames and statistically analyzing response times to determine which usernames are valid. The attack requires network access and low privileges (a valid credential attempt), but no user interaction, and the complexity is rated High due to the need for precise timing measurements. The fix was committed in changeset 3eb814e02a4c336866d4189fa0c24fd1875863ed (Django Changeset, GitHub Advisory).

Successful exploitation allows an unauthenticated or low-privileged remote attacker to enumerate valid usernames on Django applications using mod_wsgi-based authentication. This is a confidentiality-only impact — there is no integrity or availability effect. Enumerated usernames can be leveraged in follow-on attacks such as credential stuffing, brute-force login attempts, or targeted phishing, increasing the overall risk to affected deployments (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-13473. The EPSS score is approximately 0.029–0.038%, placing it in the 12th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the ability to send many timed authentication requests and perform statistical analysis, making it a moderate-effort attack limited to deployments using the mod_wsgi authentication handler (GitHub Advisory).

1. Reconnaissance: Identify Django applications using mod_wsgi for authentication (e.g., via HTTP server headers, error pages, or application behavior).
2. Baseline timing: Send authentication requests with a known non-existent username to establish a baseline response time for the check_password() function.
3. Username enumeration: Send a large number of authentication requests with candidate usernames (e.g., from a wordlist), recording precise response times for each.
4. Statistical analysis: Compare response times — usernames that trigger a longer processing time (due to password hash comparison) indicate valid accounts, while non-existent usernames return faster.
5. Compile valid usernames: Aggregate results to build a list of confirmed valid usernames for use in follow-on attacks such as brute-force or credential stuffing (GitHub Advisory, Django Security Releases).

• Network: High volume of authentication requests to mod_wsgi-protected endpoints from a single IP or small IP range, especially with many different usernames and consistent password values.
• Logs: Web server access logs showing repeated POST requests to authentication endpoints with varying usernames but identical or patterned passwords; unusually high request rates from a single source.
• Application Logs: Django authentication logs showing a large number of failed login attempts across many different usernames in a short time window, consistent with enumeration rather than targeted brute-force.

Django has released patched versions addressing this vulnerability: 4.2.28, 5.2.11, and 6.0.2. Administrators should upgrade to one of these versions as the primary remediation. As a workaround, sites not using mod_wsgi-based authentication (i.e., not using django.contrib.auth.handlers.modwsgi) are not affected and require no action. Organizations running unsupported Django series (5.0.x, 4.1.x, 3.2.x) should upgrade to a supported and patched release (Django Security Releases, GitHub Advisory).

The Django security team published a blog post on February 3, 2026 announcing the security releases and a follow-up post on February 4, 2026 discussing recent trends from the security team (Django Security Releases, Django Security Trends). Security news outlets including SecurityOnline, GBHackers, CyberSecurityNews, and CyberPress covered the Django February 2026 security patch batch, though coverage primarily focused on the more severe SQL injection and DoS vulnerabilities disclosed in the same release. Ubuntu (USN-8009-1), Debian (DLA-4484-1, DSA-6150-1), Fedora, SUSE, and Mageia all issued distribution-level advisories. IBM also flagged the vulnerability as affecting EDB Postgres AI Hybrid Management products (IBM Advisory).