CVE-2025-65430
Medium · 5.4django-allauth does not reject access tokens for inactive users
CVSS
5.4
EPSS
0.2%
Published
Dec 15, 2025
CISA due date
—
The record
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | django-allauth | 0 | 65.13.0 |
| openSUSE:Tumbleweed | python-django-allauth | 0 | 65.16.1-2.1 |
Related vulnerabilities
- CVE-2026-27982 An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when… Also affects django-allauth
- CVE-2025-65431 django-allauth's Okta and NetIQ implementations used a mutable identifier for… Also affects django-allauth
- CVE-2026-55250 Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0… CWE-613
- CVE-2026-86215 A vulnerability was identified in Mstfakts College-Management-System. CWE-613
- CVE-2026-55513 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. CWE-613
- CVE-2026-61608 SolidInvoice is an open-source invoicing platform. CWE-613
- CVE-2026-84480 WWBN AVideo fails to validate password recovery token expiration in… CWE-613
- CVE-2026-84203 Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes… CWE-613