Vulnerability in allauth-django Affects Okta and NetIQ User Authorization
CVE-2025-65431

5.4MEDIUM

Key Information:

Vendor

Django

Status
allauth-django
Vendor
CVE Published:
15 December 2025

What is CVE-2025-65431?

A security issue was found in allauth-django versions prior to 65.13.0, affecting how third-party provider accounts for Okta and NetIQ were managed. The previous usage of 'preferred_username' as an identifier raised concerns due to its mutability, which could lead to unauthorized access if used for critical authorization decisions. To enhance security, the affected providers have updated their implementation to use 'sub' for user identification. It is crucial for users and developers to update to the latest version to mitigate any potential risks.

References

https://allauth.org/news/2025/10/django-allauth-65.13.0-r...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.