CVE-2026-27982
Medium · 6.1CVSS
6.1
EPSS
0.3%
Published
Mar 5, 2026
CISA due date
—
The record
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | django-allauth | 0 | 65.14.1 |
Related vulnerabilities
- CVE-2025-65430 django-allauth does not reject access tokens for inactive users Also affects django-allauth
- CVE-2025-65431 django-allauth's Okta and NetIQ implementations used a mutable identifier for… Also affects django-allauth
- CVE-2026-87945 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO… CWE-601
- CVE-2026-87937 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central… CWE-601
- CVE-2026-112034 A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. CWE-601
- CVE-2026-101907 Axios is a promise-based HTTP client for the browser and Node.js. CWE-601
- CVE-2026-8323 URL redirection to untrusted site ('open redirect') vulnerability in Armiya Information… CWE-601
- CVE-2026-78377 URL redirection to untrusted site ('open redirect') vulnerability in Yordam Informatics… CWE-601