CVE-2026-27982
django-allauth has an open redirect vulnerability
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Active
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL.
- Record
CVE-2026-27982- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2026-9652
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL.
- Record
EUVD-2026-9652- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2jpr-83rg-v67j
django-allauth has an open redirect vulnerability
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL.
- Record
GHSA-2jpr-83rg-v67j- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL.
- Record
CVE-2026-27982- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL.
- Record
CVE-2026-27982- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-27982
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL.
- Record
DEBIAN-CVE-2026-27982- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-2jpr-83rg-v67j
django-allauth has an open redirect vulnerability
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL.
- Record
GHSA-2jpr-83rg-v67j- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVPYSEC-2026-56
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL.
- Record
PYSEC-2026-56- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-27982
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL.
- Record
UBUNTU-CVE-2026-27982- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
django-allauthPyPI |
before 65.14.1 | 65.14.1 |
django-allauthDebian:12 |
All versions, plus listed versions 0.51.0-10.58.2-264.1.0-165.0.2-165.0.2-265.15.0-165.19.1-1 |
None known |
django-allauthDebian:13 |
All versions, plus listed versions 65.0.2-165.0.2-265.15.0-165.19.1-1 |
None known |
django-allauthDebian:14 |
before 65.15.0-1, plus listed versions 65.0.2-165.0.2-2 |
65.15.0-1 |
django-allauthPyPI |
before 65.14.1, plus listed versions 0.1.00.10.00.10.10.11.00.11.1 Show 45 moreShow less0.12.00.13.00.14.00.14.10.14.20.15.00.16.00.16.10.17.00.18.00.19.00.19.10.2.00.20.00.21.00.22.00.23.00.24.00.24.10.25.00.25.10.25.20.26.00.26.10.27.00.28.00.29.00.3.00.30.00.31.00.32.00.33.00.34.00.35.00.36.00.37.00.37.10.38.00.39.00.39.10.4.00.40.00.41.00.42.00.43.0 |
65.14.1 |
django-allauthUbuntu:18.04:LTS |
All versions, plus listed versions 0.33.0-10.34.0-10.34.0-20.34.0-30.35.0-1 |
None known |
django-allauthUbuntu:20.04:LTS |
All versions, plus listed versions 0.39.1+ds-10.40.0+ds-20.41.0+ds-1 |
None known |
django-allauthUbuntu:22.04:LTS |
All versions, plus listed versions 0.44.0+ds-10.46.0+ds-10.47.0-1 |
None known |
django-allauthUbuntu:24.04:LTS |
All versions, plus listed versions 0.51.0-10.58.2-2 |
None known |
django-allauthUbuntu:25.10 |
All versions, plus listed versions 65.0.2-1 |
None known |
django-allauthUbuntu:26.10 |
All versions, plus listed versions 65.0.2-265.15.0-1 |
None known |
django-allauthUbuntu:26.04:LTS |
All versions, plus listed versions 65.0.2-165.0.2-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-27982 is a medium vulnerability (CVSS 5.1) in Allauth, published March 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in django-allauth 65.14.1.
References
allauth.org/news/2026/02/django-allauth-65.14.1-released
jvn.jp/en/jp/JVN23669411
nvd.nist.gov/vuln/detail/CVE-2026-27982
github.com/pypa/advisory-database/tree/main/vulns/django-allauth/PYSEC-2026-56.yaml
Left out here: 73 versions. The JSON record has them.