CVE catalog

CVE-2025-65430

django-allauth: CVE-2025-65430

[CVE catalog]

Severity
Medium · CVSS 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.17% · Oct 25, 2026

An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandjango-allauthsid65.19.1-1fixed
Debiandjango-allauthforky65.19.1-1fixed
Debiandjango-allauthtrixie65.0.2-1vulnerable
Debiandjango-allauthbookworm0.51.0-1vulnerable
CpeallauthNot reported65.13.0fixed
Opensusepython-django-allauthtumbleweed65.16.1-2.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandjango-allauthsourcesid65.15.0-1not yet assignedNot reported[1123085]
Debiandjango-allauthsourceforky65.15.0-1not yet assignedNot reported[1123085]
Debiandjango-allauthsourcetrixie(unfixed)not yet assignedNot reported[1123085]
Debiandjango-allauthsourcebookworm(unfixed)not yet assignedNot reported[1123085]
CpeallauthcpeNot reported65.13.0Not reportedNVD-CVE-2025-65430Not reported
Opensusepython-django-allauthrpmtumbleweed65.16.1-2.1Not reportedOPENSUSE-SU-2026:10680-1Not reported

[Debian bug #1123085]

Notes

[trixie] django-allauth: Minor issue; can be fixed via poin release [bookworm] django-allauth: Minor issue; can be fixed via poin release

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-django-allauth]Affected

    Source package: [django-allauth]

    Details (2)

    • 0.51.0-1 · all · bookworm

      Affected

      dsa · django-allauth · debian · bookworm

    • 0.51.0-1 · all · bookworm

      Affected

      dsa · django-allauth · debian · bookworm

  • [python-django-allauth-doc]Affected

    Source package: [django-allauth]

    Details (2)

    • 0.51.0-1 · all · bookworm

      Affected

      dsa · django-allauth · debian · bookworm

    • 0.51.0-1 · all · bookworm

      Affected

      dsa · django-allauth · debian · bookworm

[openSUSE Tumbleweed]

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]