CVE-2025-65430

MediumCVSS 5.4

Published: 15/12/2025(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

5th percentile - higher than 5% of all known CVEs

Summary

In allauth-django before version 65.13.0, marking a user as is_active=False after tokens had been issued while the account was still active had no effect. This was fixed so that access and refresh tokens are now rejected.

Risk Assessment

A deactivated user account could still access protected resources using previously issued tokens, breaking access control. The organization may be exposed to unauthorized access by blocked users.

Recommendation

Upgrade allauth-django to version 65.13.0 or later. After upgrading, consider revoking all active tokens issued before account deactivation.

Other vulnerabilities in allauth-django

CVE-2025-65431Medium
In allauth-django before version 65.13.0, both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.

Original NVD description (English source)

An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS