Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

pennersr/django-allauth

              main @ d7d5d39
            

136

Fixes

CVEs

HIGH

Peak severity

32.4%

Coverage

Highlights

Auth Bypass: 54 prior fixes. Scrutinize any change in this area.

allauth/account/adapter.py: most-fixed (12 issues). Treat as high-risk during review.

42 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The application suppressed ImmediateHttpResponse exceptions raised in pre_login hooks (which are designed to trigger 2FA redirections or account abort blocks), causing the authentication flow to skip 2FA challenges entirely and successfully log users in. Developers must never intercept or swallow flow control exceptions designed to redirect or abort login sequences.

Authentication Bypass: The OIDC IdP validation framework historically permitted silent login/authorization requests (prompt=none). This allowed malicious clients to silently issue credentials without explicit user consent. Developers must explicitly reject prompt=none validations in silent authorization hooks unless high-assurance user verification is separately established.

CSRF: Failure to validate the SAML InResponseTo parameter, coupled with supporting unauthenticated IdP-initiated single sign-on by default, exposes users to session-fixation and CSRF-based account linking attacks. This risk is formalized in CVE-2026-27982. SAML assertions must validate InResponseTo, and IdP-initiated SSO should be disabled by default.