Vulnerabilidades do Pip Django-allauth
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Pip Django-allauth: 2 registro(s), com versões afetadas e correções.
CVE-2025-65431
Média · 5.4
CWE-287 15/12/2025
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.
CVE-2025-65430
Média · 5.4
CWE-613 15/12/2025
django-allauth does not reject access tokens for inactive users
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.