From 48e0a64e6491b464249086d6052a00c8d2be418e Mon Sep 17 00:00:00 2001 From: Jacob Walls Date: Mon, 1 Jun 2026 11:46:08 -0400 Subject: Refs #36439 -- Added missing thread_sensitive=False to dummy password hasher path. The existing user path also uses thread_sensitive=False in acheck_password(). Follow-up to 7f66c3b41f0fb0fb938d7b96e20a28dccdaa2ecd. --- django/contrib/auth/__init__.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/django/contrib/auth/__init__.py b/django/contrib/auth/__init__.py index 723f348824..1d7199ce47 100644 --- a/django/contrib/auth/__init__.py +++ b/django/contrib/auth/__init__.py @@ -402,6 +402,7 @@ def check_password_with_timing_attack_mitigation(user, password): async def acheck_password_with_timing_attack_mitigation(user, password): """See check_user_with_timing_attack_mitigation.""" if user is None: - await sync_to_async(get_user_model()().set_password)(password) + set_password = get_user_model()().set_password + await sync_to_async(set_password, thread_sensitive=False)(password) else: return await user.acheck_password(password) -- cgit v1.3