CVE-2026-97764 Details
Description
django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit.
A vulnerability in django-allauth versions prior to 65.19.4 allows for bypassing rate limits on login attempts. This issue arises on databases with diacritic-insensitive collations, such as common MySQL/MariaDB configurations. Usernames like 'admin' and 'ádmin' can authenticate the same account while using different rate limit keys, leading to an unintended increase in the per-account rate limit. The vulnerability can be exploited by leveraging the handling of accents to exceed the allowed login attempts.
Projects using django-allauth must update to version 65.19.4 or later. Additionally, those using username authentication should remove Django's 'ModelBackend' from 'AUTHENTICATION_BACKENDS', as it does not perform the necessary checks to prevent this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-180 | Incorrect Behavior Order: Validate Before Canonicalize | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| django-allauth | < 65.19.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 25, 2026 | New CVE Received | [email protected] |