AIKIDO-2024-10436
django-allauth is vulnerable to Improper Restriction of Excessive Authentication Attempts
42
Medium Risk
This Affects:
django-allauthTL;DR
Affected versions of this package are vulnerable to a bruteforce attack due to the lack of enforcement of the 'settings.ACCOUNT_EMAIL_VERIFICATION_BY_CODE_MAX_ATTEMPTS' parameter. This issue arises because the number of attempts allowed for email account verification is not properly limited, allowing attackers to try many verification codes in a short amount of time.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
django-allauth is vulnerable to Improper Restriction of Excessive Authentication Attempts in versions 0.63.0 - 65.1.0.
How to fix this
Upgrade the django-allauth library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant