Description

django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-25T05:17:07.953Z",
  "pubdate": "2026-09-25T05:17:07.953Z",
  "executiveSummary": "The vulnerability identified in django-allauth (prior to version 65.19.4) involves an authentication rate-limiting bypass. The flaw resides in how the application processes user identifiers during failed login attempts.\nBy manipulating input strings through the strategic use of diacritical marks (accents), an attacker can circumvent standard rate-limiting mechanisms. Because the application may normalize or interpret these variations inconsistently, the system fails to count these attempts against the specific account or IP-based threshold as intended.\nThis vulnerability impacts systems utilizing django-allauth for authentication, specifically those relying on built-in login throttling to prevent brute-force or credential-stuffing attacks. The risk implication is significant, as it effectively increases the window of opportunity for an attacker to perform unauthorized password guessing.\nExploitation does not require elevated privileges and can be performed remotely by any unauthenticated attacker capable of submitting login requests. The primary requirement is the crafting of input variations that bypass the internal logic tracking account lockout or rate-limiting state.",
  "technicalDetails": "The root cause of this vulnerability lies in the normalization logic—or lack thereof—when django-allauth handles authentication identifiers during the failed login tracking process. In many database backends and application configurations, string comparison operations treat characters with diacritics as distinct from their base ASCII counterparts, yet the underlying authentication backend may normalize these characters during the actual lookup or credential validation phase.\nWhen a user submits a login attempt, the rate-limiting mechanism typically hashes or stores the identifier (e.g., email address or username) to track the count of failures. If the application processes the user-provided string using a different normalization strategy for the rate-limiting counter than it does for the database lookup, the rate-limiter fails to recognize multiple attempts as belonging to the same entity.\nAn attacker can exploit this by iterating through multiple permutations of a username or email address using equivalent unicode characters or diacritics. For example, if an attacker targets 'user@example.com', they can submit requests using 'uśer@example.com', 'usér@example.com', or other diacritic variants. If the application logic normalizes these inputs for database querying but fails to normalize them before updating the rate-limiting store, each variation is treated as a unique, fresh attempt.\nAttack flow: 1. The attacker identifies a target account. 2. The attacker submits a login request with a specific identifier variation. 3. The rate-limiter updates the failure count for that specific string. 4. The attacker submits a new request using a different diacritic variant of the same identifier. 5. Because the rate-limiter perceives the second request as belonging to a different identifier, the failure count for the original account is not incremented, thereby resetting or bypassing the configured threshold.\nThis behavior effectively grants the attacker a higher effective limit than the security policy intended, facilitating successful brute-force attacks by preventing account lockouts or temporary IP bans that should have triggered after a set number of failed attempts.\nThe vulnerable component is the authentication throttling and tracking logic within django-allauth that incorrectly maps user-provided identity strings to a consistent internal state. All versions of django-allauth prior to 65.19.4 are considered susceptible to this logic flaw. Successful exploitation allows for extended credential guessing attempts without meeting the trigger criteria for rate-limit countermeasures."
}