CVE-2026-41519: 
Python vulnerability analysis and mitigation

CVE-2026-41519 is an Insufficient Session Expiration vulnerability in Weblate, the open-source translation management platform, where Django REST Framework (DRF) API tokens (prefixed wlu_*) stored in authtoken_token are not revoked when a user changes their password. While browser sessions are correctly invalidated via cycle_session_keys(), the API tokens persist indefinitely, allowing continued unauthorized access even after a credential change. All Weblate versions prior to 5.17.1 are affected. The vulnerability was reported by Sang Yu Jeon, disclosed on April 30, 2026, and has a CVSS v3.1 base score of 4.2 (Moderate) per the GitHub Advisory (GitHub Advisory, Weblate Advisory).

The root cause is CWE-613 (Insufficient Session Expiration): Weblate's password change flow calls cycle_session_keys() to invalidate browser sessions but omits revocation of DRF API tokens stored in the authtoken_token database table (GitHub Advisory). An attacker who has previously obtained a user's API token (e.g., via phishing, credential theft, or prior compromise) can continue to authenticate to the Weblate REST API using the stale wlu_* token even after the victim resets their password. Exploitation requires low privileges (a valid account with an API token) and network access to the Weblate instance, but no user interaction. The fix introduced a reset_api_token() helper and a regenerate_api_key checkbox (enabled by default) in the SetPasswordForm, ensuring the old token is deleted and a new one is issued on password change (Weblate Commit).

An attacker who possesses a victim's API token retains full API-level access to the Weblate instance even after the victim changes their password, undermining the primary security benefit of a password reset. This enables unauthorized reading and modification of translation data (low confidentiality and integrity impact), and could facilitate persistent access in post-compromise scenarios where the victim believes their account has been secured. Availability is not directly impacted, and the scope is limited to the affected user's account (GitHub Advisory, Weblate Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-41519. The EPSS score is approximately 0.026% (1st percentile), indicating a very low probability of near-term exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to have already obtained a valid API token through a prior compromise, making opportunistic mass exploitation unlikely.

1. Obtain API Token: Through a prior compromise (e.g., phishing, credential stuffing, or access to exposed logs/configuration), the attacker acquires a victim's Weblate API token with the wlu_* prefix.
2. Victim Changes Password: The victim, aware of or suspecting a compromise, changes their Weblate password, expecting all active sessions and credentials to be invalidated.
3. Verify Token Persistence: On a vulnerable Weblate instance (< 5.17.1), the attacker sends an authenticated API request using the old token, e.g., curl -H 'Authorization: Token wlu_<token>' https://<weblate-host>/api/ and confirms the token remains valid.
4. Maintain Persistent Access: The attacker continues to use the stale API token to read translation data, modify translations, or enumerate project information via the Weblate REST API, bypassing the victim's password reset (GitHub Advisory, Weblate Commit).

• Network: Unexpected or anomalous API requests to the Weblate REST API (/api/) using a wlu_* prefixed token from unfamiliar IP addresses, particularly after a user has changed their password.
• Logs: Weblate access logs showing successful API authentication (HTTP 200) with a token that predates a recent password change event for the same user account.
• Application: Presence of old wlu_* tokens in the authtoken_token database table with a creation timestamp significantly older than the user's last password change timestamp in the auth_user table.

Upgrade Weblate to version 5.17.1 or later, which resolves this issue by regenerating the API token by default when a user changes their password (Weblate Release). As an immediate workaround on unpatched instances, affected users can manually revoke and regenerate their API token via their Weblate profile settings. Administrators can also directly delete stale tokens from the authtoken_token database table for users who have recently changed their passwords. No configuration-only mitigation is available without upgrading.

The vulnerability was reported responsibly by Sang Yu Jeon and acknowledged by the Weblate maintainer (nijel), who developed and merged the fix on April 17, 2026, ahead of the public disclosure on April 30, 2026 (Weblate PR). The NixOS/nixpkgs project tracked the issue for downstream packaging (Weblate PR). An openSUSE security announcement was also issued, indicating distribution-level awareness and patching activity (GitHub Advisory). No significant broader media coverage or notable community controversy has been observed.