Affected versions of allauth are vulnerable to account enumeration through timing attacks (CWE-203). This vulnerability allows attackers to determine the existence of user accounts by measuring response times during email/password authentication attempts. The issue resides in the AuthenticationBackend._authenticate_by_email method, which did not mitigate timing discrepancies. Exploitation can be performed remotely with high feasibility. Users should update to the latest version of allauth to apply the implemented timing attack mitigations.

Affected versions of Django-allauth are vulnerable to CSRF and replay attacks in the SAML login flow. RelayStatewas used to keep track of whether or not the login flow was IdP or SP initiated. As RelayState is a separate field, not part of the SAMLResponse payload, it was not signed, causing the vulnerability.

Django-allauth 0.47.0 adds a new setting 'SOCIALACCOUNT_LOGIN_ON_GET' that controls whether or not the endpoints for initiating a social login (for example, "/accounts/google/login/") require a POST request to initiate the handshake. As requiring a POST is more secure, the default of this new setting is 'False'. This is useful to prevent redirect attacks.

In Django-allauth, a vulnerability allows attackers to inject arbitrary JavaScript into the login page when configuring the Facebook provider to use the `js_sdk` method, potentially compromising user sessions or stealing sensitive information.

On django-allauth before 0.34.0 the "Set Password" view did not properly check whether or not the user already had a usable password set. This allowed an attacker to set the password without providing the current password, but only in case the attacker already gained control over the victim's session.

Affected versions of the django-allauth package are vulnerable to Authorization Bypass due to the use of a mutable identifier (preferred_username) from third-party providers for authorization decisions. The authentication logic in django-allauth’s social account handling uses the preferred_username field from Okta and NetIQ OpenID Connect identity providers as the canonical user identifier, which may be changed by an attacker and is not stable enough to base authorization on; the code fails to validate that the identifier is immutable.

Django-allauth 0.41.0 conforms to the general Django 3.0.1, 2.2.9, and 1.11.27 security release. See CVE-2019-19844 and <https://www.djangoproject.com/weblog/2019/dec/18/security-releases/>.

Affected versions of the django-allauth package are vulnerable to Insufficient Session Expiration due to access and refresh tokens remaining valid after the associated user account is deactivated. In django-allauth’s IdP OpenID Connect implementation, allauth/idp/oidc/internal/oauthlib/request_validator.py does not check instance.user.is_active in validate_bearer_token() and validate_refresh_token(), and allauth/idp/oidc/internal/oauthlib/device_codes.py previously returned token state without revalidating the user’s active status.

Django-allauth 0.54.0 includes a security fix: Even when account enumeration prevention was turned on, it was possible for an attacker to infer whether or not a given account exists based upon the response time of an authentication attempt.