CVE-2025-65431

MediumCVSS 5.4

Published: 15/12/2025(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

In allauth-django before version 65.13.0, both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.

Risk Assessment

Using a mutable value like preferred_username for authorization decisions may allow an attacker to impersonate another user by changing the username. This may lead to unauthorized access to resources.

Recommendation

Upgrade allauth-django to version 65.13.0 or later, which uses sub as the identifier. Review the configuration of Okta and NetIQ providers for any use of preferred_username in existing integrations.

Other vulnerabilities in allauth-django

CVE-2025-65430Medium
In allauth-django before version 65.13.0, marking a user as is_active=False after tokens had been issued while the account was still active had no effect. This was fixed so that access and refresh tokens are now rejected.

Original NVD description (English source)

An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS