AIKIDO-2025-10319
django-allauth is vulnerable to Improper Restriction of Excessive Authentication Attempts
20
Low Risk
This Affects:
django-allauthTL;DR
Affected versions of this package are vulnerable to a rate-limiting bypass due to improper handling of failed login attempts. It allows an attacker to reset the rate limit for an IP address by performing a successful login, effectively bypassing brute-force protection. An attacker could exploit this by first making multiple failed login attempts, then using a known or guessed password to log in successfully, clearing the rate limit, and allowing further brute-force attempts.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
django-allauth is vulnerable to Improper Restriction of Excessive Authentication Attempts in versions 0.56.0 - 65.8.0.
How to fix this
Upgrade the django-allauth library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.