CVE-2026-97764 in django-allauth
Summary
by MITRE • 09/25/2026
django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The django-allauth library, prior to version 65.19.4, contains a logic flaw within its authentication mechanism that undermines the intended security controls regarding brute-force protection. Specifically, the rate limiting system designed to restrict failed login attempts fails to enforce strict boundaries when user input involves diacritical characters or accented letters. This vulnerability arises from how the library normalizes and compares username fields during the authentication process against stored credentials in the database. In many common configurations where case-insensitivity is enabled but character normalization for accents is not strictly enforced at the point of rate-limiting evaluation, an attacker can exploit this discrepancy to bypass throttling mechanisms.
From a technical perspective, the core issue lies in the mismatch between how usernames are validated and how they are counted against failure limits. When a user attempts to log in with a username containing diacritics, such as café or naïve, the authentication backend may normalize these characters for database lookup purposes but fail to apply the same normalization logic when incrementing the failed attempt counter. Consequently, an attacker can submit variations of a target username that differ only by the presence or absence of accents. Each variation is treated as a distinct login attempt by the rate limiter because it does not recognize them as belonging to the same logical account under the flawed comparison logic. This allows the effective limit on failed attempts to be significantly higher than configured, effectively neutralizing the brute-force protection intended for that specific user account.
The operational impact of this vulnerability is substantial in environments where django-allauth is used for managing user authentication. Attackers can perform credential stuffing or password guessing attacks against targeted accounts with a much larger number of retries before being locked out. This increases the probability of successfully compromising an account, particularly if users employ weak passwords that are susceptible to offline cracking after exposure through successful login attempts. The vulnerability affects systems where case-insensitive username handling is enabled alongside standard database collations that may treat accented and non-accented characters as equivalent for search purposes but not consistently for security counters. This creates a predictable bypass path that does not require complex exploitation techniques, making it accessible to automated attack tools.
This flaw aligns with CWE-798: Use of Hard-coded Credentials in the context of authentication logic failures, and more specifically relates to CWE-307: Improper Restriction of Excessive Authentication Attempts. The behavior also maps to MITRE ATT&CK technique T1110.004: Brute Force - Password Spraying, as it facilitates undetected or prolonged guessing attacks by evading standard lockout policies. Security practitioners should recognize that this is not a buffer overflow or injection vulnerability but rather a logical error in state management and input normalization within the authentication workflow.
To mitigate this risk, organizations using django-allauth must upgrade to version 65.19.4 or later immediately upon availability. This release addresses the inconsistency by ensuring that username comparisons for both authentication validation and rate-limiting counters use identical normalization rules. Until an upgrade is possible, administrators should consider implementing additional external protections such as IP-based throttling at the web server level using tools like Nginx limit_req_zone or Apache mod_ratelimit. These network-level controls provide a consistent layer of defense that does not rely on application-side logic for counting attempts and can effectively block high-volume login requests regardless of internal username handling nuances. Additionally, enforcing multi-factor authentication adds a critical secondary barrier that mitigates the risk posed by successful password guessing attacks resulting from this vulnerability.