p PatchFirst

CVE-2026-27982

CVE-2026-27982

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL.

CVSS 5.1 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • django-allauth

    Versions
    • prior to 65.14.1: Affected

    No fix published

  • django-allauth Debian:12

    Versions
    • 0.51.0-1
    • 0.58.2-2
    • 64.1.0-1
    • 65.0.2-1
    • 65.0.2-2
    • 65.15.0-1
    • 65.19.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • django-allauth Debian:13

    Versions
    • 65.0.2-1
    • 65.0.2-2
    • 65.15.0-1
    • 65.19.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • django-allauth Debian:14

    Versions
    • 65.0.2-1
    • 65.0.2-2
    Affected ranges
    • ECOSYSTEM: < 65.15.0-1

    Update to 65.15.0-1

  • django-allauth PyPI

    Versions
    • 0.1.0
    • 0.10.0
    • 0.10.1
    • 0.11.0
    • 0.11.1
    • 0.12.0
    • 0.13.0
    • 0.14.0
    • 0.14.1
    • 0.14.2
    • 0.15.0
    • 0.16.0
    • 0.16.1
    • 0.17.0
    • 0.18.0
    • 0.19.0
    • 0.19.1
    • 0.2.0
    • 0.20.0
    • 0.21.0
    • 0.22.0
    • 0.23.0
    • 0.24.0
    • 0.24.1
    • 0.25.0
    • 0.25.1
    • 0.25.2
    • 0.26.0
    • 0.26.1
    • 0.27.0
    • 0.28.0
    • 0.29.0
    • 0.3.0
    • 0.30.0
    • 0.31.0
    • 0.32.0
    • 0.33.0
    • 0.34.0
    • 0.35.0
    • 0.36.0
    • 0.37.0
    • 0.37.1
    • 0.38.0
    • 0.39.0
    • 0.39.1
    • 0.4.0
    • 0.40.0
    • 0.41.0
    • 0.42.0
    • 0.43.0
    • 0.44.0
    • 0.45.0
    • 0.46.0
    • 0.47.0
    • 0.48.0
    • 0.49.0
    • 0.5.0
    • 0.50.0
    • 0.51.0
    • 0.52.0
    • 0.53.0
    • 0.53.1
    • 0.54.0
    • 0.55.0
    • 0.55.1
    • 0.55.2
    • 0.56.0
    • 0.56.1
    • 0.57.0
    • 0.57.1
    • 0.57.2
    • 0.58.0
    • 0.58.1
    • 0.58.2
    • 0.59.0
    • 0.6.0
    • 0.60.0
    • 0.60.1
    • 0.61.0
    • 0.61.1
    • 0.62.0
    • 0.62.1
    • 0.63.0
    • 0.63.1
    • 0.63.2
    • 0.63.3
    • 0.63.4
    • 0.63.5
    • 0.63.6
    • 0.7.0
    • 0.8.0
    • 0.8.1
    • 0.8.2
    • 0.8.3
    • 0.9.0
    • 64.0.0
    • 64.1.0
    • 64.2.0
    • 64.2.1
    • 65.0.0
    • 65.0.1
    • 65.0.2
    • 65.1.0
    • 65.10.0
    • 65.11.0
    • 65.11.1
    • 65.11.2
    • 65.12.0
    • 65.12.1
    • 65.13.0
    • 65.13.1
    • 65.14.0
    • 65.2.0
    • 65.3.0
    • 65.3.1
    • 65.4.0
    • 65.4.1
    • 65.5.0
    • 65.6.0
    • 65.7.0
    • 65.8.0
    • 65.8.1
    • 65.9.0
    Affected ranges
    • ECOSYSTEM: < 65.14.1

    Update to 65.14.1

  • django-allauth Ubuntu:18.04:LTS

    Versions
    • 0.33.0-1
    • 0.34.0-1
    • 0.34.0-2
    • 0.34.0-3
    • 0.35.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • django-allauth Ubuntu:20.04:LTS

    Versions
    • 0.39.1+ds-1
    • 0.40.0+ds-2
    • 0.41.0+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • django-allauth Ubuntu:22.04:LTS

    Versions
    • 0.44.0+ds-1
    • 0.46.0+ds-1
    • 0.47.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • django-allauth Ubuntu:24.04:LTS

    Versions
    • 0.51.0-1
    • 0.58.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • django-allauth Ubuntu:25.10

    Versions
    • 65.0.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • django-allauth Ubuntu:26.10

    Versions
    • 65.0.2-2
    • 65.15.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • django-allauth Ubuntu:26.04:LTS

    Versions
    • 65.0.2-1
    • 65.0.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →