AIKIDO-2026-10203
django-allauth is vulnerable to Open Redirect
51
Medium Risk
This Affects:
django-allauthTL;DR
Affected versions of this package are vulnerable to open redirect when SAML IdP-initiated single sign-on is enabled (default disabled). The application uses the RelayState parameter without proper validation, allowing an attacker to supply a crafted URL that redirects authenticated users to an external, attacker-controlled site after login.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and SAML IdP-initiated single sign-on is enabled.
Background info
django-allauth is vulnerable to Open Redirect in versions 0.58.0 - 65.14.0.
How to fix this
Upgrade the django-allauth library to the patch version.
Links
github.com/pennersr/django-allauth/blob/main/ChangeLog.rst#65141-2026-02-07
allauth.org/news/2026/02/django-allauth-65.14.1-released/jvn.jp/en/jp/JVN23669411/
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.