CVE-2026-27982

An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled it is disabled by default, which may allow an attacker to redirect users to an arbitrary external website via a crafted URL...

PT-2026-23133

Name of the Vulnerable Software and Affected Versions django-allauth versions prior to 65.14.1 Description An open redirect issue exists when SAML IdP initiated SSO is enabled, which is disabled by default. This may allow an attacker to redirect users to an arbitrary external website through a...

CVE-2025-65430

An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as isactive=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected...

django-allauth does not reject access tokens for inactive users

An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as isactive=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected...

django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions

An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferredusername as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead...

GHSA-8M3C-C723-H4P4 django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions

An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferredusername as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead...

GHSA-QHMC-3MVR-F2J4 django-allauth does not reject access tokens for inactive users

An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as isactive=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected...

Improper Certificate Validation

Overview django-allauth is an integrated set of Django applications addressing authentication, registration, account management as well as 3rd party social account authentication. Affected versions of this package are vulnerable to Improper Certificate Validation via the preferredusername field...

Insufficient Session Expiration

Overview django-allauth is an integrated set of Django applications addressing authentication, registration, account management as well as 3rd party social account authentication. Affected versions of this package are vulnerable to Insufficient Session Expiration due to the improper handling of...

CVE-2025-65430

CVE-2025-65430 affects allauth-django prior to 65.13.0. The issue arises when an IdP marks a user as is_active=False after tokens have been issued for that user, leaving active tokens potentially usable. The root cause is that marking the user inactive had no effect on existing tokens. The publis...

Timing Attack

Overview django-allauth is an integrated set of Django applications addressing authentication, registration, account management as well as 3rd party social account authentication. Affected versions of this package are vulnerable to Timing Attack in the AuthenticationBackend.authenticatebyemail...

OPENSUSE-SU-2024:14065-1 python310-django-allauth-0.63.3-1.1 on GA media

These are all security issues fixed in the python310-django-allauth-0.63.3-1.1 package on the GA media of openSUSE Tumbleweed...

Authentication Bypass

django-allauth is vulnerable to authentication bypass attacks. The vulnerability exists as the checkpassword function used in the authentication backend failed to reject authentication to a user if isactive=False is set...

Information Disclosure

django-allauth is vulnerable to information disclosure. The library passes the password reset token in the URL, allowing a malicious user to obtain the reset token through the referrer header...

Cross-Site Scripting (XSS)

django-allauth is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary javascript via the facebook and persona providers because the fields do not escape javascript...