CVE-2025-65430: Allauth

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.

Affected products

• Allauth Allauth: before 65.13.0 (fixed in 65.13.0)

Published 2025-12-15. Last modified 2026-06-17.