News
django-allauth 65.19.4 released
Posted by Raymond Penners on 2026-09-17
Security notice Account: On databases with broad Unicode collations (e.g. common MySQL/MariaDB configurations), usernames such as admin and ádmin, or email addresses containing compatibility characters, could authenticate the same account while consuming different rate limit keys. This resulted in a larger than intended per account rate limit.
Read moredjango-allauth 65.19.3 released
Posted by Raymond Penners on 2026-09-11
Fixes Account: The email address data migrations (0006 and 0008) did not honor the database selected using migrate --database, potentially querying or updating the default database instead. Fixed. MFA: Fixed various race conditions involving TOTP and recovery codes. Security notice Headless: When HEADLESS_JWT_STATEFUL_VALIDATION_ENABLED is on, JWT access tokens are now rejected after the password changes outside of the allauth password-change flow (for example via set_password() in a shell).
Read moredjango-allauth 65.19.2 released
Posted by Raymond Penners on 2026-09-01
Fixes Headless: Posting a well-formed JSON payload that was not an object (e.g. a list or a string) to the headless endpoints resulted in a server error. Security notice MFA: TOTP enrollment code verification was not rate limited. Impact is limited, as to exploit this you would need to be already fully authenticated, pass (rate-limited) reauthentication, and brute force within a 30s TOTP window.
Read moredjango-allauth 65.19.1 released
Posted by Raymond Penners on 2026-08-13
Fixes IdP: Fixed an incorrect URL reverse in the OpenID Connect authorization template. It silently resolved to an empty form action (posting back to the same URL), so the flow kept working regardless. IdP: Redirectable errors from the authorization endpoint were not delivered to clients registered with an app native (non-http(s)) redirect_uri.
Read moredjango-allauth 65.19.0 released
Posted by Raymond Penners on 2026-08-06
Noteworthy changes Officially support Django 6.1. IdP: Added support for Client ID Metadata Document (CIMD). IdP: Added IDP_OIDC_REFRESH_TOKEN_EXPIRES_IN, allowing refresh tokens to expire. Combined with IDP_OIDC_ROTATE_REFRESH_TOKEN, this results in a sliding (inactivity) window. Defaults to None (no expiry), preserving the previous behavior.
Read more