Listen to this Post
How the Mentioned CVE Works:
The vulnerability exists in the Django-allauth social authentication adapters for Okta and NetIQ (OpenID Connect) prior to version 65.13.0. These adapters incorrectly used the `preferred_username` claim from the identity provider’s (IdP) userinfo endpoint as the primary, immutable identifier to bind the remote account to a local Django user account. The `preferred_username` claim is inherently mutable and can be changed by an administrator or sometimes the user within the IdP (e.g., Okta or NetIQ). An attacker who can change their own `preferred_username` claim in the IdP to match that of a victim user could potentially link their own IdP account to the victim’s existing local account in the Django application during a subsequent login. This flawed binding logic could lead to account takeover, as authorization decisions and user identity are incorrectly tied to a changeable attribute instead of the stable, unique, and immutable `sub` (subject) claim provided by the OpenID Connect standard.
DailyCVE Form:
Platform: Django-allauth
Version: < 65.13.0
Vulnerability: Insecure Identifier Binding
Severity: Moderate
Date: 2025-12-15
Prediction: Patch 2025-12-31
What Undercode Say:
pip show django-allauth grep -r "preferred_username" .
Risky old adapter logic uid = resp['preferred_username'] Fixed logic uses 'sub' uid = resp['sub']
How Exploit:
1. Attacker changes Okta `preferred_username`.
2. Attacker logs into application.
- Application binds attacker to victim’s local account via mutable username.
4. Account takeover achieved.
Protection from this CVE:
Upgrade to 65.13.0.
Verify `sub` claim usage.
Implement secondary authentication checks.
Impact:
Account Takeover.
Privilege Escalation.
Broken Authentication.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
