The Rate Limit That Wasn't: Bruteforcing django-allauth's Email Verification Code

Thu, 21 Nov 2024 00:00:00 +0000

“The street finds its own uses for things.” — William Gibson

How I Got Here

In late 2024 I scoped out an engagement for Radically Open Security targeting django-allauth — one of the most widely-used authentication libraries for Django. The audit was funded by NLnet as part of the NGI Zero Entrust programme, and focused on newly added features: Passkey WebAuthN support, login by code, email verification by code, and the allauth.headless API.

Django on harpi - Security Researcher

The Rate Limit That Wasn't: Bruteforcing django-allauth's Email Verification Code

How I Got Here