CVE-2026-97764: Low severity pypi/django-allauth vulnerability
django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
django-allauthto a version that resolves this vulnerability.Fixed in 65.19.4
Event History
Frequently Asked Questions
Which deployments are most likely to be exposed to this issue?
Deployments using django-allauth versions before 65.19.4 may be exposed when they use one of the common configurations affected by diacritic handling. The issue concerns failed-login attempt limits rather than successful authentication.
What does an attacker need to exploit the higher effective login-attempt limit?
An attacker needs to make failed login attempts in a way that leverages diacritics, such as accented characters. No privileges or user interaction are required, but the attack complexity is rated high.
How can I determine whether my application is affected?
Check whether django-allauth is installed at a version earlier than 65.19.4. Then review whether your login-attempt limiting configuration is among the common configurations where diacritic handling can produce a higher effective limit.