CVE-2026-97764
django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for
allauth django-allauthFrameworks
CVSS
3.7LowExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 65.19.4django-allauthCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit.
Text from CVE List
Affected versions 1
- django-allauthaffected: 0.25.0 before 65.19.4CVE List
References 5
- docs.allauth.org/en/latest/release-notes/recent.htmlFixvia CVE List
- codeberg.org/allauth/django-allauth/commit/4379e7931fe7572aacc4f3b4b5f2298d5f3ecc96Fixvia CVE List
- codeberg.org/allauth/django-allauth/commit/4e252aa2be7cef5d72d78049d6fb07cb27a89c83Fixvia CVE List
- codeberg.org/allauth/django-allauth/commit/ae472772c8f93bcb972205c9d7159051cf6f413aFixvia CVE List
- pypi.org/project/django-allauth/Referencevia CVE List