Threats affecting pkg:pypi/django-allauth

CVE-2026-97764 is a vulnerability in django-allauth before version 65.19.4 where the handling of diacritics in login attempts can bypass expected limits on failed login attempts. This occurs due to incorrect ordering of validation and canonicalization processes, allowing attackers to effectively increase the number of allowed failed logins in some configurations.

An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL.