CVE-2026-27982: django-allauth has an open redirect vulnerability

March 5, 2026

An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL.

References

allauth.org/news/2026/02/django-allauth-65.14.1-released
github.com/advisories/GHSA-2jpr-83rg-v67j
github.com/pennersr/django-allauth
jvn.jp/en/jp/JVN23669411
nvd.nist.gov/vuln/detail/CVE-2026-27982

Code Behaviors & Features

Detect and mitigate CVE-2026-27982 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →