---
id: CVE-2025-65431
title: An issue was discovered in allauth-django before 65.13.0
summary: >-
  An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ
  were using preferred_username as the identifier for third-party provider
  accounts. That value may be mutable and should therefore be avoided for
  authorization …
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-287
vendor: allauth
product: allauth
affected:
  - allauth < 65.13.0
patched:
  - allauth 65.13.0
published: '2025-12-15'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-65431'
references:
  - url: 'https://allauth.org/news/2025/10/django-allauth-65.13.0-released/'
    label: cve@mitre.org
tags:
  - nvd
epss: 0.00164
epssPercentile: 0.05154
ingestedAt: '2026-10-14T13:30:58.426Z'
---

## Overview

An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.

## Affected

- `allauth < 65.13.0`

## Remediation

Upgrade past the affected range:

- `allauth 65.13.0`