allauth vulnerabilities
CVEs whose affected-version data names the allauth package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2025-65431Medium· 5.4An issue was discovered in allauth-django before 65.13.0
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization …
▾ Sunlitallauth · allauthEPSS 0.16%via NVD
CVE-2025-65430Medium· 5.4An issue was discovered in allauth-django before 65.13.0
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.
▾ Sunlitallauth · allauthEPSS 0.17%via NVD