Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
CVE-2026-97764: django-allauth permits unlimited login attempts using accented characters
CVE-2026-97764 · published 24 days ago
Summary
The django-allauth sign‑in system does not properly count failed login tries when users include accented letters, letting an attacker try many passwords without lockout. This can let attackers eventually guess a correct password. Update to the latest version of django-allauth or enable stricter login‑attempt controls to protect your accounts.
What to do
- Update allauth django-allauth to version 65.19.4 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | allauth | django-allauth | < 65.19.4 |
| Ubuntu:18.04:LTS | canonical | django-allauth | All versions |
| Debian:12 | debian | django-allauth | All versions |
Original advisory text
DEBIAN-CVE-2026-97764
django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit.
References
- https://codeberg.org/allauth/django-allauth/commit/4379e7931fe7572aacc4f3b4b5f22... Third Party Advisory
- https://codeberg.org/allauth/django-allauth/commit/4e252aa2be7cef5d72d78049d6fb0... Third Party Advisory
- https://ubuntu.com/security/CVE-2026-97764 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-97764 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-97764 Vendor Advisory
- https://codeberg.org/allauth/django-allauth/commit/ae472772c8f93bcb972205c9d7159... Third Party Advisory
- https://docs.allauth.org/en/latest/release-notes/recent.html Third Party Advisory
- https://pypi.org/project/django-allauth/ Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-180Incorrect Behavior Order: Validate Before Canonicalize
Timeline
Published25 Sep 2026
Updated19 Oct 2026
First seen25 Sep 2026
Sources
CVE-2026-97764 · NVD
CVE-2026-97764 · MITRE
UBUNTU-CVE-2026-97764 · OSV
DEBIAN-CVE-2026-97764 · OSV
Track software like this
Free during beta