Pip Django-allauth vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Pip Django-allauth: 2 record(s), with affected versions and fixes.
CVE-2025-65431
Medium · 5.4
CWE-287 Dec 15, 2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.
CVE-2025-65430
Medium · 5.4
CWE-613 Dec 15, 2025
django-allauth does not reject access tokens for inactive users
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.