CVE-2025-65431
Medium · 5.4django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
CVSS
5.4
EPSS
0.2%
Published
Dec 15, 2025
CISA due date
—
The record
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | django-allauth | 0 | 65.13.0 |
| openSUSE:Tumbleweed | python-django-allauth | 0 | 65.16.1-2.1 |
Related vulnerabilities
- CVE-2026-27982 An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when… Also affects django-allauth
- CVE-2025-65430 django-allauth does not reject access tokens for inactive users Also affects django-allauth
- CVE-2026-114638 Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the… CWE-287
- CVE-2026-114639 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass… CWE-287
- CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. CWE-287
- CVE-2026-107228 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-287
- CVE-2026-86781 The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40… CWE-287
- CVE-2026-14563 The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the… CWE-287