Django 6.1's PBKDF2 default change rewrites existing password hashes on next login
Django 6.1 shipped in August with a one-line change to django.contrib.auth: the default PBKDF2 iteration count for password hashing went from 1,200,000 to 1,500,000. That's the kind of release note entry I'd normally skim past. I timed it instead, and then went looking at what else moves when that one number changes. It turned out to move more than the login latency. I installed Django 6.1.2 and, separately, 6.0.9 in their own virtualenvs so I could call the hasher directly with each version's d
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.