CVE-2025-13473 Username enumeration through timing difference in mod_wsgi authentication handler

🗓️ 03 Feb 2026 14:32:26Reported by GoogleType

osv🔗 osv.dev👁 5 Views

CVE-2025-13473: Timing attack allows remote user enumeration via mod_wsgi check_password in Django before affected versions.

Reporter	Title	Published	Views	Family All 90
IBM Security Bulletins	Security Bulletin: Enumeration of users, compromised data confidentiality and integrity, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service	23 Mar 202616:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses django-4.2.27-py3-none-any.whl which is vulnerable to CVE-2025-13473, CVE-2025-14550, CVE-2026-1207, CVE-2026-1285, CVE-2026-1287, CVE-2026-1312.	30 Mar 202607:02	–	ibm
ATTACKERKB	CVE-2025-13473	3 Feb 202614:32	–	attackerkb
AlpineLinux	CVE-2025-13473	3 Feb 202614:32	–	alpinelinux
BDU FSTEC	The vulnerability of the Django web application platform, related to the disclosure of information based on temporal discrepancies, allows attackers to gain unauthorized access to protected information.	23 Mar 202600:00	–	bdu_fstec
Chainguard	CVE-2025-13473 vulnerabilities	5 Feb 202601:17	–	cgr
Circl	CVE-2025-13473	3 Feb 202615:53	–	circl
CNNVD	Django 安全漏洞	3 Feb 202600:00	–	cnnvd
CVE	CVE-2025-13473	3 Feb 202614:32	–	cve
Cvelist	CVE-2025-13473 Username enumeration through timing difference in mod_wsgi authentication handler	3 Feb 202614:32	–	cvelist

Source	Link
github	www.github.com/django/django/
docs	www.docs.djangoproject.com/en/dev/releases/security/
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13473.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-13473
djangoproject	www.djangoproject.com/weblog/2026/feb/03/security-releases/
pypi	www.pypi.org/project/Django/
groups	www.groups.google.com/g/django-announce

15 Jul 2026 10:14Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.15.3

EPSS0.00713