Django versions 5.0 prior to 5.0.7 and 4.2 prior to 4.2.14 contain a vulnerability in the authentication backend that allows remote attackers to enumerate valid users via a timing attack on login requests involving users with unusable passwords. This issue has been fixed in versions 5.0.7 and 4.2.14.