🎯 New Report #3825141: API token sent to URL dictated by an untrusted project .weblate file
🔺Severity: Medium
👽 Reporter: type5afe
⭐️ Reputation: 157
🛠 State: resolved
💼 Team: Weblate
💵 Bounty: null
🕐 Submitted: 2026-06-25
⏰ Disclosed: 2026-09-04 08:10:51
📝 Summary: A vulnerability was discovered in the wlc Python library used to interact with the Weblate translation management system. The vulnerability allowed an untrusted .weblate file to specify the Weblate API URL, which could then receive the API token set in the environment. The API token was resolved independently and was not bound to a trusted URL source, allowing the secret to be sent to an attacker-chosen server.
📂 Report JSON File: 3825141
@hackeronereports