AIKIDO-2025-10728
django-phone-verify is vulnerable to Improper Restriction of Excessive Authentication Attempts
47
Medium Risk
This Affects:
django-phone-verifyTL;DR
Affected versions of this package are vulnerable to brute force attacks due to insufficient protection against repeated SMS verification attempts. The patched version introduces comprehensive safeguards, including MAX_FAILED_ATTEMPTS (default: 5) to limit failed verification attempts before session lockout, MIN_TOKEN_LENGTH (default: 6) to enforce a minimum security code length, and a new failed_attempts field in the SMSVerification model with a migration for backward compatibility. These enhancements prevent automated attacks and improve the overall security of the verification process.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
django-phone-verify is vulnerable to Improper Restriction of Excessive Authentication Attempts in versions 0.1.0 - 3.1.0.
How to fix this
Upgrade the django-phone-verify library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant