JVN#23669411
django-allauth vulnerable to open redirect

Overview

django-allauth contains an open redirect vulnerability.

Products Affected

• django-allauth versions prior to 65.14.1

Description

django-allauth is a package for implementing user authentication in Django applications. django-allauth contains the following vulnerability.

• Open redirect (CWE-601)
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 5.1
  • CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Base Score 4.3
  • CVE-2026-27982

Impact

An open redirect vulnerability exists in django-allauth when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL.

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.