allauth has 3 CVEs on record between 2025 and 2026. 1 was published in the last 90 days. The median CVSS is 5.4 (medium). Most affected products: allauth (2), django-allauth (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 1 prev 0
Worst active — by depth score
CVE-2025-65431Medium· 5.4An issue was discovered in allauth-django before 65.13.030CVE-2025-65430Medium· 5.4An issue was discovered in allauth-django before 65.13.030CVE-2026-97764Low· 3.7django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit.20
allauth vulnerabilities
CVEs affecting allauth, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-97764Low· 3.7django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit.
django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit.
CVE-2025-65431Medium· 5.4An issue was discovered in allauth-django before 65.13.0
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization …
CVE-2025-65430Medium· 5.4An issue was discovered in allauth-django before 65.13.0
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.