django-allauth 65.21.1 released
Posted by Raymond Penners on 2026-10-30
Fixes
- IdP: Allow resource indicators passed in an authorization request's resource parameter to use URIs with a trailing slash.
- socialaccount: Reduced login failures when multiple authentication flows are running in parallel browser tabs. Pending provider states are now persisted eagerly and preserved when the same user logs in again.
Security notice
- Fixed rate limits with multiple windows for the same scope sharing a cache entry, which could bypass longer windows and overcount requests in shorter windows. Thanks to Daniel Denson for reporting.
- MFA: Passwordless WebAuthn registration and login did not consistently enforce user verification. Passkey flows now always require a PIN, biometric, or equivalent user verification. User verification for WebAuthn MFA and reauthentication can now be controlled using MFA_WEBAUTHN_USER_VERIFICATION.
Previous: django-allauth 65.21.0 released