Allauth is a widely embedded authentication library used across Django-based applications to provide social login, multi-account, and credential-management functionality. Its disclosures cluster around authentication-layer weaknesses, including improper authentication checks, insufficient session-expiration enforcement, and open-redirect vulnerabilities in OAuth and login-flow handling, reflecting the complex state management required of a multi-provider auth abstraction. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Allauth over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-65431MEDIUM An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be m | Dec 15, 2025 | 5.4 | 20 | NO | NO |
CVE-2025-65430MEDIUM An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no | Dec 15, 2025 | 5.4 | 20 | NO | NO |
CVE-2026-27982MEDIUM An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to | Mar 5, 2026 | 6.1 | 19 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Allauth.
Media articles that mention a CVE ID that affects a product developed by Allauth — matched by CVE ID, not by vendor name.