4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41519

CVE-2026-41519: Weblate's API Token Not Invalidated on Password Change

Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions are correctly invalidated via "cycle_session_keys()", but DRF API tokens ("wlu_*" prefix) stored in "authtoken_token" are not revoked. This issue has been patched in version 5.17.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41519

CVE-2026-41519:

4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
weblate	pip	< 5.17.1	5.17.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the failure to invalidate API tokens when a user changes their password. The analysis of the provided patch commit 649a2da81700542f95c0807b3c625fc3bb0eaf95 reveals that the fix was implemented in the weblate/accounts/forms.py file. Specifically, the save method of the SetPasswordForm class was modified to include a call to a new reset_api_token function. This form is used in both the password change view for logged-in users and the password reset flow. Before this change, the save method only changed the password without affecting the API token, allowing for continued unauthorized access. Therefore, the SetPasswordForm.save method is identified as the vulnerable function, as it was the component that lacked the necessary security measure.

Vulnerable functions

SetPasswordForm.save

weblate/accounts/forms.py

The `save` method of the `SetPasswordForm` is responsible for updating a user's password. Before the patch, this method did not invalidate the user's API token. This meant that if an attacker had compromised a user's account and the user subsequently changed their password, the attacker would retain access to the account via the API token. The patch adds a call to `reset_api_token` to invalidate the old token and generate a new one, thus mitigating the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.