django-allauth 65.21.0 released
Posted by Raymond Penners on 2026-10-26
Note worthy changes
- To give more granular control over when reauthentication is required, two new settings are introduced: MFA_REAUTHENTICATION_REQUIRED and SOCIALACCOUNT_REAUTHENTICATION_REQUIRED. Additionally, you can provide custom logic via the new adapter method is_reauthentication_required().
Security notice
- Headless: Reaching the phone verification attempt limit did not abort pending login/signup flows. Note that code expiry and SMS sending rate limits remained in effect.
- MFA: Fixed an issue where authentication records from an inactive user's passwordless WebAuthn login could carry over to a subsequent login in the same browser session, causing MFA to be skipped for the subsequent user.
Next: django-allauth 65.21.1 released Previous: django-allauth 65.20.1 released