{"id":"CVE-2025-65430","aliases":["DEBIAN-CVE-2025-65430","EUVD-2025-203377","GHSA-qhmc-3mvr-f2j4","PYSEC-2025-110","UBUNTU-CVE-2025-65430","openSUSE-SU-2026:10680-1"],"status":"published","title":"django-allauth does not reject access tokens for inactive users","description":"An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00164,"percentile":0.0562,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-613"],"published":"2025-12-15T00:00:00Z","modified":"2026-10-28T02:31:12Z","fixes":[{"ecosystem":"PyPI","package":"django-allauth","fixed_in":["65.13.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"django-allauth","fixed_in":["65.15.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django-allauth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"65.13.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"django-allauth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.51.0-1","0.58.2-2","64.1.0-1","65.0.2-1","65.0.2-2","65.15.0-1","65.19.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"django-allauth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["65.0.2-1","65.0.2-2","65.15.0-1","65.19.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"django-allauth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"65.15.0-1"}]}],"versions":["65.0.2-1","65.0.2-2"]},{"source":"osv","ecosystem":"PyPI","package":"django-allauth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"65.13.0"}]}],"versions":["0.1.0","0.10.0","0.10.1","0.11.0","0.11.1","0.12.0","0.13.0","0.14.0","0.14.1","0.14.2","0.15.0","0.16.0","0.16.1","0.17.0","0.18.0","0.19.0","0.19.1","0.2.0","0.20.0","0.21.0","0.22.0","0.23.0","0.24.0","0.24.1","0.25.0","0.25.1","0.25.2","0.26.0","0.26.1","0.27.0","0.28.0","0.29.0","0.3.0","0.30.0","0.31.0","0.32.0","0.33.0","0.34.0","0.35.0","0.36.0","0.37.0","0.37.1","0.38.0","0.39.0","0.39.1","0.4.0","0.40.0","0.41.0","0.42.0","0.43.0","0.44.0","0.45.0","0.46.0","0.47.0","0.48.0","0.49.0","0.5.0","0.50.0","0.51.0","0.52.0","0.53.0","0.53.1","0.54.0","0.55.0","0.55.1","0.55.2","0.56.0","0.56.1","0.57.0","0.57.1","0.57.2","0.58.0","0.58.1","0.58.2","0.59.0","0.6.0","0.60.0","0.60.1","0.61.0","0.61.1","0.62.0","0.62.1","0.63.0","0.63.1","0.63.2","0.63.3","0.63.4","0.63.5","0.63.6","0.7.0","0.8.0","0.8.1","0.8.2","0.8.3","0.9.0","64.0.0","64.1.0","64.2.0","64.2.1","65.0.0","65.0.1","65.0.2","65.1.0","65.10.0","65.11.0","65.11.1","65.11.2","65.12.0","65.12.1","65.2.0","65.3.0","65.3.1","65.4.0","65.4.1","65.5.0","65.6.0","65.7.0","65.8.0","65.8.1","65.9.0"]},{"source":"osv","ecosystem":"PyPI","package":"django-allauth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"65.13.0"}]}],"versions":["0.1.0","0.10.0","0.10.1","0.11.0","0.11.1","0.12.0","0.13.0","0.14.0","0.14.1","0.14.2","0.15.0","0.16.0","0.16.1","0.17.0","0.18.0","0.19.0","0.19.1","0.2.0","0.20.0","0.21.0","0.22.0","0.23.0","0.24.0","0.24.1","0.25.0","0.25.1","0.25.2","0.26.0","0.26.1","0.27.0","0.28.0","0.29.0","0.3.0","0.30.0","0.31.0","0.32.0","0.33.0","0.34.0","0.35.0","0.36.0","0.37.0","0.37.1","0.38.0","0.39.0","0.39.1","0.4.0","0.40.0","0.41.0","0.42.0","0.43.0","0.44.0","0.45.0","0.46.0","0.47.0","0.48.0","0.49.0","0.5.0","0.50.0","0.51.0","0.52.0","0.53.0","0.53.1","0.54.0","0.55.0","0.55.1","0.55.2","0.56.0","0.56.1","0.57.0","0.57.1","0.57.2","0.58.0","0.58.1","0.58.2","0.59.0","0.6.0","0.60.0","0.60.1","0.61.0","0.61.1","0.62.0","0.62.1","0.63.0","0.63.1","0.63.2","0.63.3","0.63.4","0.63.5","0.63.6","0.7.0","0.8.0","0.8.1","0.8.2","0.8.3","0.9.0","64.0.0","64.1.0","64.2.0","64.2.1","65.0.0","65.0.1","65.0.2","65.1.0","65.10.0","65.11.0","65.11.1","65.11.2","65.12.0","65.12.1","65.2.0","65.3.0","65.3.1","65.4.0","65.4.1","65.5.0","65.6.0","65.7.0","65.8.0","65.8.1","65.9.0"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"django-allauth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.33.0-1","0.34.0-1","0.34.0-2","0.34.0-3","0.35.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"django-allauth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.39.1+ds-1","0.40.0+ds-2","0.41.0+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"django-allauth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.44.0+ds-1","0.46.0+ds-1","0.47.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"django-allauth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.51.0-1","0.58.2-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"django-allauth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["65.0.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"django-allauth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["65.0.2-2","65.15.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"django-allauth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["65.0.2-1","65.0.2-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-django-allauth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"65.16.1-2.1"}]}],"bundled":2}],"products":[{"vendor":"allauth","product":"allauth"}],"references":[{"url":"https://allauth.org/news/2025/10/django-allauth-65.13.0-released/","tags":["Release Notes","web","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65430","tags":["advisory"]},{"url":"https://allauth.org/news/2025/10/django-allauth-65.13.0-released","tags":["web"]},{"url":"https://github.com/pennersr/django-allauth/commit/39f4a4ce9c891795b00914ca5ec32de72d5369c0","tags":["web"]},{"url":"https://github.com/pennersr/django-allauth/commit/c54edf947c5a1c8c4ff3cddb75c86000ecb2507d","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django-allauth/PYSEC-2025-110.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qhmc-3mvr-f2j4","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65430.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-65430","tags":["advisory"]},{"url":"https://codeberg.org/allauth/django-allauth","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-65430","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-65430","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-65430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-65431","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-65430","description":"An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.","status":"published","published":"2025-12-15T00:00:00Z","modified":"2025-12-15T15:40:25.05Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:32:26.64278Z"}],"euvd":[{"id":"EUVD-2025-203377","description":"An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.","status":"published","published":"2025-12-15T00:00:00Z","modified":"2025-12-15T15:40:25Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:05.447386Z"}],"ghsa":[{"id":"GHSA-qhmc-3mvr-f2j4","title":"django-allauth does not reject access tokens for inactive users","description":"An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.","status":"published","published":"2025-12-15T15:30:31Z","modified":"2026-06-05T14:34:46Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:40:17.745826Z"}],"nvd":[{"id":"CVE-2025-65430","description":"An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.","status":"published","published":"2025-12-15T14:15:57.017Z","modified":"2026-10-14T13:10:00.187Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:11:50.400521Z"}],"osv":[{"id":"CVE-2025-65430","description":"An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.","status":"published","published":"2025-12-15T00:00:00Z","modified":"2026-10-28T02:31:12.857809717Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:52.202386Z"},{"id":"DEBIAN-CVE-2025-65430","description":"An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.","status":"published","published":"2025-12-15T14:15:57.017Z","modified":"2026-10-15T09:47:42.755247768Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"GHSA-qhmc-3mvr-f2j4","title":"django-allauth does not reject access tokens for inactive users","description":"An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.","status":"published","published":"2025-12-15T15:30:31Z","modified":"2026-06-05T14:45:52.531291001Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"PYSEC-2025-110","description":"An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.","status":"published","published":"2025-12-15T14:15:57.017Z","modified":"2026-06-10T17:00:47.43159972Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:54.242332Z"},{"id":"UBUNTU-CVE-2025-65430","description":"An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.","status":"published","published":"2025-12-15T14:15:00Z","modified":"2026-10-17T12:57:11.188447359Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:52.345622Z"},{"id":"openSUSE-SU-2026:10680-1","title":"python311-django-allauth-65.16.1-2.1 on GA media","description":"These are all security issues fixed in the python311-django-allauth-65.16.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-04T00:00:00Z","modified":"2026-05-05T07:46:53.371749Z","updated_at":"2026-11-02T16:58:38.415593Z"}]}}