News
django-allauth 65.19.7 released
Posted by Raymond Penners on 2026-10-01
Security notice The Tumblr providers (both tumblr and tumblr_oauth2) used mutable blog names as the identifier for third-party accounts. If a blog name changed and was then claimed by another user, that user could log in to the original owner's account.
Read moredjango-allauth 65.19.6 released
Posted by Raymond Penners on 2026-09-30
Security notice The minimum OAuthLib version for the socialaccount and idp-oidc extras is now 4.0.0, incorporating upstream security fixes for GHSA-hj66-6f7g-4r5v and GHSA-xpv3-w29h-x7cv. The Bitbucket and Pinterest providers used mutable usernames as the identifier for third-party accounts. If a username changed and was then claimed by another user, that user could log in to the original owner's account.
Read moredjango-allauth 65.19.5 released
Posted by Raymond Penners on 2026-09-28
Security notice Account: When the potentially unsafe ALLOWED_HOSTS = ["*"] configuration was used, arbitrary redirect URLs were considered safe, allowing open redirects. The wildcard is now ignored when validating redirect destinations. Thanks to John Tipton and Yuji Egami for reporting.
Read moredjango-allauth 65.19.4 released
Posted by Raymond Penners on 2026-09-17
Security notice Account: On databases with broad Unicode collations (e.g. common MySQL/MariaDB configurations), usernames such as admin and ádmin, or email addresses containing compatibility characters, could authenticate the same account while consuming different rate limit keys. This resulted in a larger than intended per account rate limit.
Read moredjango-allauth 65.19.3 released
Posted by Raymond Penners on 2026-09-11
Fixes Account: The email address data migrations (0006 and 0008) did not honor the database selected using migrate --database, potentially querying or updating the default database instead. Fixed. MFA: Fixed various race conditions involving TOTP and recovery codes. Security notice Headless: When HEADLESS_JWT_STATEFUL_VALIDATION_ENABLED is on, JWT access tokens are now rejected after the password changes outside of the allauth password-change flow (for example via set_password() in a shell).
Read more