django-allauth
Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication.
Activity
- Latest release
- 3d ago
- Total releases
- 136
- Cadence
- ~14 days
- Last 12 months
- 18
Details
- License
- MIT
- First release
- Feb 12, 2011
| Version | Released | |
|---|---|---|
65.19.3
patch
|
65.19.3
patch
Dependencies (10)
+ 2 more |
|
65.19.2
patch
|
65.19.2
patch
Dependencies (10)
+ 2 more |
|
65.19.1
patch
|
65.19.1
patch
Dependencies (10)
+ 2 more |
|
65.19.0
minor
|
65.19.0
minor
Dependencies (10)
+ 2 more |
|
65.18.0
minor
|
65.18.0
minor
Dependencies (10)
+ 2 more |
|
65.17.0
minor
|
65.17.0
minor
Dependencies (10)
+ 2 more |
|
65.16.1
patch
|
65.16.1
patch
Dependencies (10)
+ 2 more |
|
65.16.0
minor
|
65.16.0
minor
Dependencies (10)
+ 2 more |
|
65.15.1
patch
|
65.15.1
patch
Dependencies (10)
+ 2 more |
|
65.15.0
minor
|
65.15.0
minor
Dependencies (10)
+ 2 more |
|
65.14.3
patch
|
65.14.3
patch
Dependencies (10)
+ 2 more |
|
65.14.2
patch
|
65.14.2
patch
Dependencies (10)
+ 2 more |
|
65.14.1
patch
|
65.14.1
patch
Dependencies (10)
+ 2 more |
|
65.14.0
minor
1 CVE
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev |
65.14.0
minor
Dependencies (10)
+ 2 more |
|
65.13.1
patch
1 CVE
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev |
65.13.1
patch
Dependencies (10)
+ 2 more |
|
65.13.0
minor
1 CVE
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev |
65.13.0
minor
Dependencies (10)
+ 2 more |
|
65.12.1
patch
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
65.12.1
patch
Dependencies (10)
+ 2 more |
|
65.12.0
minor
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
65.12.0
minor
Dependencies (10)
+ 2 more |
|
65.11.2
patch
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
65.11.2
patch
Dependencies (10)
+ 2 more |
|
65.11.1
patch
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
65.11.1
patch
Dependencies (10)
+ 2 more |
|
65.11.0
minor
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
65.11.0
minor
Dependencies (10)
+ 2 more |
|
65.10.0
minor
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
65.10.0
minor
Dependencies (9)
+ 1 more |
|
65.9.0
minor
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
65.9.0
minor
Dependencies (10)
+ 2 more |
|
65.8.1
patch
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
65.8.1
patch
Dependencies (9)
+ 1 more |
|
65.8.0
minor
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
65.8.0
minor
Dependencies (9)
+ 1 more |
|
65.7.0
minor
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
65.7.0
minor
Dependencies (9)
+ 1 more |
|
65.6.0
minor
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
65.6.0
minor
Dependencies (9)
+ 1 more |
|
65.5.0
minor
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
65.5.0
minor
Dependencies (9)
+ 1 more |
|
65.4.1
patch
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
65.4.1
patch
Dependencies (9)
+ 1 more |
|
65.4.0
minor
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
65.4.0
minor
Dependencies (9)
+ 1 more |
|
65.3.1
patch
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
65.3.1
patch
Dependencies (9)
+ 1 more |
|
65.3.0
minor
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
65.3.0
minor
Dependencies (9)
+ 1 more |
|
65.2.0
minor
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
65.2.0
minor
Dependencies (9)
+ 1 more |
|
65.1.0
minor
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
65.1.0
minor
Dependencies (9)
+ 1 more |
|
65.0.2
patch
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
65.0.2
patch
Dependencies (8)
|
|
65.0.1
patch
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
65.0.1
patch
Dependencies (8)
|
|
65.0.0
major
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
65.0.0
major
Dependencies (8)
|
|
64.2.1
patch
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
64.2.1
patch
Dependencies (8)
|
|
64.2.0
minor
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
64.2.0
minor
Dependencies (8)
|
|
64.1.0
minor
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
64.1.0
minor
Dependencies (8)
|
|
64.0.0
major
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
64.0.0
major
Dependencies (8)
|
|
0.63.6
patch
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
0.63.6
patch
Dependencies (7)
|
|
0.63.5
patch
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
0.63.5
patch
Dependencies (7)
|
|
0.63.4
patch
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
0.63.4
patch
Dependencies (7)
|
|
0.63.3
patch
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
0.63.3
patch
Dependencies (7)
|
|
0.63.2
patch
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
0.63.2
patch
Dependencies (7)
|
|
0.63.1
patch
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
0.63.1
patch
Dependencies (7)
|
|
0.63.0
minor
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
0.63.0
minor
Dependencies (7)
|
|
0.62.1
patch
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
0.62.1
patch
Dependencies (7)
|
|
0.62.0
minor
3 CVEs
CVE-2026-27982
GHSA-2jpr-83rg-v67j
PYSEC-2026-56
Mar 05, 2026
django-allauth has an open redirect vulnerability
Medium
Network
Low
None
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 111 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.13.0
65.13.1
65.14.0
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.14.1
References Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65431
GHSA-8m3c-c723-h4p4
PYSEC-2025-111
Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev
CVE-2025-65430
GHSA-qhmc-3mvr-f2j4
PYSEC-2025-110
Dec 15, 2025
django-allauth does not reject access tokens for inactive users
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected. Affected versions
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
+ 108 more Show less
0.16.1
0.17.0
0.18.0
0.19.0
0.19.1
0.2.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.3.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.37.1
0.38.0
0.39.0
0.39.1
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.5.0
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.55.2
0.56.0
0.56.1
0.57.0
0.57.1
0.57.2
0.58.0
0.58.1
0.58.2
0.59.0
0.6.0
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
64.0.0
64.1.0
64.2.0
64.2.1
65.0.0
65.0.1
65.0.2
65.1.0
65.10.0
65.11.0
65.11.1
65.11.2
65.12.0
65.12.1
65.2.0
65.3.0
65.3.1
65.4.0
65.4.1
65.5.0
65.6.0
65.7.0
65.8.0
65.8.1
65.9.0
Fixed in
65.13.0
References
Updated Jun 05, 2026 · Source: OSV.dev |
0.62.0
minor
Dependencies (7)
|