django-allauth 65.19.2 released
Posted by Raymond Penners on 2026-09-01
Fixes
- Headless: Posting a well-formed JSON payload that was not an object (e.g. a list or a string) to the headless endpoints resulted in a server error.
Security notice
- MFA: TOTP enrollment code verification was not rate limited. Impact is limited, as to exploit this you would need to be already fully authenticated, pass (rate-limited) reauthentication, and brute force within a 30s TOTP window.
Previous: django-allauth 65.19.1 released