Low
CVE-2026-97764
django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit.
Announced Group revision 1
Original source ↗CVE-2026-97764
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-97764
django-allauth
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://codeberg.org/allauth/django-allauth",
"vendor": "allauth",
"modules": [
"allauth.account.utils",
"allauth.account.adapter.DefaultAccountAdapter"
],
"product": "django-allauth",
"versions": [
{
"status": "affected",
"version": "0.25.0",
"lessThan": "65.19.4",
"versionType": "custom"
}
],
"packageURL": "pkg:pypi/django-allauth",
"packageName": "django-allauth",
"programFiles": [
"allauth/account/utils.py",
"allauth/account/adapter.py"
],
"collectionURL": "https://pypi.org",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "allauth.account.utils.filter_users_by_username()"
},
{
"name": "allauth.account.utils.filter_users_by_email()"
},
{
"name": "allauth.account.utils._unicode_ci_compare()"
},
{
"name": "allauth.account.adapter.DefaultAccountAdapter._get_login_attempts_cache_key()"
}
]
}
]- Related CVEs
- CVE-2026-97764
Source reference:
/cveMetadata/cveId
Publisher severity
low
Source reference: /containers/cna/metrics
- Event
- #2083 · Revision 1
- Added to Heist Feed
- Publisher date