CVE-2025-65431: Allauth

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.

Affected products

• Allauth Allauth: before 65.13.0 (fixed in 65.13.0)

Published 2025-12-15. Last modified 2026-06-17.