CVE-2026-97764 allauth CVE debrief

Who should care

Defenders responsible for authentication systems, especially those using django-allauth, should assess exposure and verify configurations. Roles responsible for authentication systems, especially those using django-allauth, should assess exposure and verify configurations. The impact is low-severity but requires verification and possible configuration adjustments.

Why it matters

Defenders should care about CVE-2026-97764 because it affects django-allauth's handling of login attempts, potentially allowing brute-force attacks. Roles responsible for authentication systems, especially those using django-allauth, should assess exposure and verify configurations. The impact is low-severity but requires verification and possible configuration adjustments.

• Potential for increased exposure to brute-force attacks on user accounts.
• Need for verification of django-allauth configurations and versions.
• Possible impact on authentication system security.

Technical summary

The django-allauth package before version 65.19.4 does not properly limit failed login attempts in certain configurations due to its handling of diacritics. This could potentially allow attackers to perform brute-force attacks on user accounts. The issue requires verification and possible configuration adjustments. Official CVE Program record and NVD vulnerability detail provide additional context. The CVE record was published on 2026-09-25T05:17:07.953Z and has not been modified since then. The impact is low-severity.

Defensive priority

Defenders should prioritize verifying django-allauth versions and configurations, especially where authentication is exposed.

Recommended defensive actions

• Verify django-allauth version is 65.19.4 or later.
• Review configurations for diacritic handling.
• Monitor authentication logs for unusual activity.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

Evidence from the CVE Program and NVD indicates a low-severity issue with django-allauth's handling of login attempts. The CVE record was published on 2026-09-25T05:17:07.953Z and has not been modified since then. Official CVE Program record and NVD vulnerability detail provide additional context. The issue is related to diacritic handling in some configurations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.