TI-2026-64275 Aliases CVE-2026-97764 GHSA-qwgm-hfpp-4pf6

django-allauth before 65.19.4 does not have the expected limits on failed login attempts…

LOW 17CWE-180Published 2026-09-25 · Updated 2026-09-25

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00226 13th percentileScored 2026-11-07

Fix Fixed django-allauth (allauth): 65.19.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
allauth	django-allauth	0.25.0 to before 65.19.4	65.19.4	Patch available	CNA

django-allauth Vendorallauth Affected 0.25.0 to before 65.19.4 Fixed in 65.19.4 Patch available CNA

Remediation

Fix · CNA django-allauth (allauth) Fixed in 65.19.4

Timeline

2026-10-02 Threatist record created from CVE-2026-97764
2026-10-03 Alias added: GHSA-qwgm-hfpp-4pf6

References

Patch 2

Other 3

TI-2025-40360 An issue was discovered in allauth-django before 65.13.0. CVSS 3.1MEDIUM 5.4
TI-2025-40359 An issue was discovered in allauth-django before 65.13.0. CVSS 3.1MEDIUM 5.4
TI-2026-22324 Open redirect in allauth django-allauth CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences