CVE-2025-65431

MEDIUM

allauth < 65.13.0 - Improper Authentication via Mutable preferred_username Identifier

Title source: llm

Description

An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.

References (1)

Core 1

Core References

Release Notes

https://allauth.org/news/2025/10/django-allauth-65.13.0-released/

Scores

CVSS v3 5.4

EPSS 0.0014

EPSS Percentile 3.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-287

Status published

Products (2)

allauth/allauth < 65.13.0

pypi/django-allauth 0 - 65.13.0PyPI

Published Dec 15, 2025

Tracked Since Feb 18, 2026