---
id: CVE-2025-65430
title: An issue was discovered in allauth-django before 65.13.0
summary: >-
  An issue was discovered in allauth-django before 65.13.0. IdP: marking a user
  as is_active=False after having handed tokens for that user while the account
  was still active had no effect. Fixed the access/refresh tokens are now
  rejected.
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-613
vendor: allauth
product: allauth
affected:
  - allauth < 65.13.0
patched:
  - allauth 65.13.0
published: '2025-12-15'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-65430'
references:
  - url: 'https://allauth.org/news/2025/10/django-allauth-65.13.0-released/'
    label: cve@mitre.org
tags:
  - nvd
epss: 0.00165
epssPercentile: 0.05279
ingestedAt: '2026-10-14T13:30:58.426Z'
---

## Overview

An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.

## Affected

- `allauth < 65.13.0`

## Remediation

Upgrade past the affected range:

- `allauth 65.13.0`