Listen to this Post
In django-allauth versions prior to 65.13.0, a flaw exists in the Identity Provider (IdP) component regarding session management and token validation. When a user account is deactivated by setting the Django `is_active` flag to False, the system fails to invalidate previously issued OAuth 2.0 access and refresh tokens. These tokens, acquired while the account was active, remain functional and are not rejected during subsequent authorization checks. The vulnerability stems from the token validation endpoint not querying the user’s active status from the database when verifying token authenticity. Instead, it relies solely on the token’s signature and expiration, neglecting the account state. Consequently, an attacker in possession of a valid token from a previously active user can continue to access protected resources and API endpoints impersonating that user, even after administrative deactivation. This bypasses intended security controls for account suspension or termination. The issue is particularly relevant in scenarios where user accounts are disabled due to security incidents, policy violations, or leaving an organization. The fix implemented in version 65.13.0 modifies the token validation logic to include a check for `user.is_active` before granting access, ensuring tokens are rejected for inactive accounts.
DailyCVE Form:
Platform: django-allauth
Version: pre-65.13.0
Vulnerability: Inactive token acceptance
Severity: Moderate
date: 2025-12-15
Prediction: Patched 2025-12-15
What Undercode Say:
Analytics
pip show django-allauth grep -r "is_active" allauth/ python manage.py check --deploy
Example vulnerable token check (simplified) def validate_token(token): user = User.objects.get_by_token(token) Missing check: if not user.is_active: raise InvalidToken return user
How Exploit:
An attacker retains access tokens from a compromised or former user account. After the account is deactivated by an administrator (is_active=False), the attacker continues to use the old tokens to authenticate and authorize requests to the application’s APIs or protected views, maintaining unauthorized access.
Protection from this CVE
Upgrade to django-allauth version 65.13.0 or later. Implement immediate token revocation upon user deactivation. Monitor and audit active sessions. Use short-lived tokens and require re-authentication for critical actions.
Impact:
Unauthorized access persistence, privilege escalation, data breach from deactivated accounts, compliance violations.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
