News
django-allauth 65.21.1 released
Posted by Raymond Penners on 2026-10-30
Fixes IdP: Allow resource indicators passed in an authorization request's resource parameter to use URIs with a trailing slash. socialaccount: Reduced login failures when multiple authentication flows are running in parallel browser tabs. Pending provider states are now persisted eagerly and preserved when the same user logs in again.
Read moredjango-allauth 65.21.0 released
Posted by Raymond Penners on 2026-10-26
Note worthy changes To give more granular control over when reauthentication is required, two new settings are introduced: MFA_REAUTHENTICATION_REQUIRED and SOCIALACCOUNT_REAUTHENTICATION_REQUIRED. Additionally, you can provide custom logic via the new adapter method is_reauthentication_required(). Security notice Headless: Reaching the phone verification attempt limit did not abort pending login/signup flows.
Read moredjango-allauth 65.20.1 released
Posted by Raymond Penners on 2026-10-20
Security notice MFA: Fixed a denial-of-service vulnerability where unauthenticated passwordless WebAuthn login attempts could consume the per-user rate limit and lock a targeted account out of TOTP authentication. MFA: Fixed a vulnerability (introduced in 65.20.0) that allowed a TOTP code to be reused within its validity window by submitting it in an alternative representation.
Read moredjango-allauth 65.20.0 released
Posted by Raymond Penners on 2026-10-16
Note worthy changes A recent login no longer counts for views that require reauthentication. Users must now explicitly reauthenticate. OpenID Connect providers can now override values from the server's discovery document using openid_configuration_overrides. Account: Visiting signup now cancels pending login flows.
Read moredjango-allauth 65.19.7 released
Posted by Raymond Penners on 2026-10-01
Security notice The Tumblr providers (both tumblr and tumblr_oauth2) used mutable blog names as the identifier for third-party accounts. If a blog name changed and was then claimed by another user, that user could log in to the original owner's account.
Read more