CVE-2026-104974 Plane: Disabled User Auto-Reactivation on Login

Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting isactive=False can still log in with existing credentials. Successful authentication silently changes isactive back to True, reactivating the account without notifying the...

CVE-2026-104974 Plane: Disabled User Auto-Reactivation on Login

Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting isactive=False can still log in with existing credentials. Successful authentication silently changes isactive back to True, reactivating the account without notifying the...

CVE-2026-104974 Plane: Disabled User Auto-Reactivation on Login

Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting isactive=False can still log in with existing credentials. Successful authentication silently changes isactive back to True, reactivating the account without notifying the...

CVE-2025-65430: Insufficient Session Expiration

An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as isactive=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected...

Authentication Bypass

django-allauth is vulnerable to authentication bypass attacks. The vulnerability exists as the checkpassword function used in the authentication backend failed to reject authentication to a user if isactive=False is set...