Fixed #26614 -- Used constant_time_compare() in checking session auth hash in login().

1 files changed, 1 insertions, 1 deletions

diff --git a/django/contrib/auth/__init__.py b/django/contrib/auth/__init__.py
index 4f4f08987a..6f2a2e45c3 100644
--- a/django/contrib/auth/__init__.py
+++ b/django/contrib/auth/__init__.py
@@ -100,7 +100,7 @@ def login(request, user, backend=None):
     if SESSION_KEY in request.session:
         if _get_user_session_key(request) != user.pk or (
                 session_auth_hash and
-                request.session.get(HASH_SESSION_KEY) != session_auth_hash):
+                not constant_time_compare(request.session.get(HASH_SESSION_KEY, ''), session_auth_hash)):
             # To avoid reusing another user's session, create a new, empty
             # session if the existing session corresponds to a different
             # authenticated user.