CVE-2025-65431
📋 TL;DR
This vulnerability in django-allauth allows attackers to potentially impersonate users when using Okta or NetIQ third-party authentication. The issue occurs because these providers used mutable 'preferred_username' values for user identification instead of immutable 'sub' claims. All django-allauth installations using Okta or NetIQ authentication are affected.
💻 Affected Systems
- django-allauth
📦 What is this software?
Allauth by Allauth
⚠️ Risk & Real-World Impact
Worst Case
Attackers could impersonate legitimate users, gain unauthorized access to accounts, and potentially escalate privileges within the application.
Likely Case
Account takeover through authentication bypass, allowing attackers to access user data and perform actions as the compromised user.
If Mitigated
Limited impact with proper monitoring and quick patching, though some authentication anomalies might occur.
🎯 Exploit Status
Exploitation requires understanding of OAuth/OIDC flows and ability to modify user attributes in Okta/NetIQ.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 65.13.0
Vendor Advisory: https://allauth.org/news/2025/10/django-allauth-65.13.0-released/
Restart Required: Yes
Instructions:
1. Update django-allauth: pip install django-allauth==65.13.0
2. Restart your Django application
3. Verify Okta/NetIQ authentication still works correctly
🔧 Temporary Workarounds
Disable Okta/NetIQ authentication
allTemporarily disable affected authentication providers until patching is complete
Remove Okta and NetIQ from AUTHENTICATION_BACKENDS in Django settings
🧯 If You Can't Patch
- Implement additional authentication checks beyond username matching
- Monitor authentication logs for suspicious username changes or duplicate accounts
🔍 How to Verify
Check if Vulnerable:
Check if django-allauth version <65.13.0 and Okta/NetIQ authentication is configuredCheck Version:
pip show django-allauth | grep VersionVerify Fix Applied:
Verify django-allauth version is 65.13.0 or higher and authentication works correctly📡 Detection & Monitoring
Log Indicators:
- Multiple authentication attempts with same user ID but different usernames
- Authentication failures followed by successful logins with modified usernames
Network Indicators:
- Unusual OAuth/OIDC token requests to Okta/NetIQ endpoints
SIEM Query:
source="django" AND ("authentication" OR "login") AND ("Okta" OR "NetIQ") AND ("preferred_username" OR "username_change")