django-allauth 65.19.1 released
Posted by Raymond Penners on 2026-08-13
Fixes
- IdP: Fixed an incorrect URL reverse in the OpenID Connect authorization template. It silently resolved to an empty form action (posting back to the same URL), so the flow kept working regardless.
- IdP: Redirectable errors from the authorization endpoint were not delivered to clients registered with an app native (non-http(s)) redirect_uri.
Security notice
- IdP: The OpenID Connect RP-initiated logout endpoint honored any post_logout_redirect_uri that could not be tied to a registered client, making it an open redirector. It now only redirects to URIs that can be verified as registered. The impact is low: no tokens or secrets are exposed, it merely allowed redirecting the user agent to an arbitrary URL after logout.
Previous: django-allauth 65.19.0 released