PT-2026-23133 · Unknown · Allauth-Django

Ayato Shitomi + 1 · Published 2026-03-05 · Updated 2026-03-09 · CVE-2026-27982

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions django-allauth versions prior to 65.14.1

Description An open redirect issue exists when SAML IdP initiated SSO is enabled, which is disabled by default. This may allow an attacker to redirect users to an arbitrary external website through a crafted URL.

Recommendations Update to django-allauth version 65.14.1 or later.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-27982

GHSA-2JPR-83RG-V67J

PYSEC-2026-56

Affected Products

Allauth-Django

References · 15

• https://security-tracker.debian.org/tracker/CVE-2026-27982 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27982 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27982 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27982 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-56 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-27982 · Security Note
• https://osv.dev/vulnerability/GHSA-2jpr-83rg-v67j · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27982 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27982 · Vendor Advisory
• https://github.com/pennersr/django-allauth · Note
• https://allauth.org/news/2026/02/django-allauth-65.14.1-released · Note
• https://jvn.jp/en/jp/JVN23669411 · Note
• https://t.me/cveNotify/154853 · Telegram Post
• https://twitter.com/CVEnew/status/2030755409854673254 · Twitter Post
• https://t.me/CVEtracker/46411 · Telegram Post