CVE-2025-65431
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.
- Record
CVE-2025-65431- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2025-203376
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.
- Record
EUVD-2025-203376- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8m3c-c723-h4p4
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.
- Record
GHSA-8m3c-c723-h4p4- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
NVD
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.
- Record
CVE-2025-65431- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.
- Record
CVE-2025-65431- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-65431
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.
- Record
DEBIAN-CVE-2025-65431- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-8m3c-c723-h4p4
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.
- Record
GHSA-8m3c-c723-h4p4- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVPYSEC-2025-111
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.
- Record
PYSEC-2025-111- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-65431
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.
- Record
UBUNTU-CVE-2025-65431- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10680-1 No score
python311-django-allauth-65.16.1-2.1 on GA media
These are all security issues fixed in the python311-django-allauth-65.16.1-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10680-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
django-allauthPyPI |
before 65.13.0 | 65.13.0 |
django-allauthDebian:12 |
All versions, plus listed versions 0.51.0-10.58.2-264.1.0-165.0.2-165.0.2-265.15.0-165.19.1-1 |
None known |
django-allauthDebian:13 |
All versions, plus listed versions 65.0.2-165.0.2-265.15.0-165.19.1-1 |
None known |
django-allauthDebian:14 |
before 65.15.0-1, plus listed versions 65.0.2-165.0.2-2 |
65.15.0-1 |
django-allauthPyPI |
before 65.13.0, plus listed versions 0.1.00.10.00.10.10.11.00.11.1 Show 45 moreShow less0.12.00.13.00.14.00.14.10.14.20.15.00.16.00.16.10.17.00.18.00.19.00.19.10.2.00.20.00.21.00.22.00.23.00.24.00.24.10.25.00.25.10.25.20.26.00.26.10.27.00.28.00.29.00.3.00.30.00.31.00.32.00.33.00.34.00.35.00.36.00.37.00.37.10.38.00.39.00.39.10.4.00.40.00.41.00.42.00.43.0 |
65.13.0 |
django-allauthUbuntu:18.04:LTS |
All versions, plus listed versions 0.33.0-10.34.0-10.34.0-20.34.0-30.35.0-1 |
None known |
django-allauthUbuntu:20.04:LTS |
All versions, plus listed versions 0.39.1+ds-10.40.0+ds-20.41.0+ds-1 |
None known |
django-allauthUbuntu:22.04:LTS |
All versions, plus listed versions 0.44.0+ds-10.46.0+ds-10.47.0-1 |
None known |
django-allauthUbuntu:24.04:LTS |
All versions, plus listed versions 0.51.0-10.58.2-2 |
None known |
django-allauthUbuntu:25.10 |
All versions, plus listed versions 65.0.2-1 |
None known |
django-allauthUbuntu:26.10 |
All versions, plus listed versions 65.0.2-265.15.0-1 |
None known |
django-allauthUbuntu:26.04:LTS |
All versions, plus listed versions 65.0.2-165.0.2-2 |
None known |
python-django-allauthopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 65.16.1-2.1 | 65.16.1-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-65431 is a medium vulnerability (CVSS 5.4) in Allauth, published December 15, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. Fixed in django-allauth 65.13.0.
References
allauth.org/news/2025/10/django-allauth-65.13.0-released
nvd.nist.gov/vuln/detail/CVE-2025-65431
github.com/pennersr/django-allauth/commit/8feef46e0e07b25fc5594c8f268afa247ebc3412
Left out here: 70 versions. The JSON record has them.