Django Allauth: Account Takeover via Provider Identifier Mutability

Wed, 25 Dec 2024 00:00:00 +0000

“There’s always a side door.”

Overview

I discovered an account takeover vulnerability in django-allauth, one of the most widely-used authentication libraries for Django. The vulnerability allows an attacker to impersonate arbitrary users by exploiting how certain OAuth providers’ identifiers are resolved.

Vulnerability Details

CVE: CVE-2025-65431 Type: Improper Authentication / Account Takeover (CWE-287) Impact: Account Impersonation Affected Versions: django-allauth < 65.13.0

The Bug

Both the Okta and NetIQ providers were using preferred_username as the identifier for third-party provider accounts. This value is mutable — users can change their preferred_username on the identity provider side.

Account-Takeover on harpi - Security Researcher

Django Allauth: Account Takeover via Provider Identifier Mutability

Overview

Vulnerability Details

The Bug