Django Allauth
Monthly
Bypass of failed-login rate limiting in django-allauth before 65.19.4 allows unauthenticated remote attackers to obtain a higher effective number of login attempts in certain common configurations by submitting diacritic variants of the same username or email. The flaw is a low-severity defense-in-depth weakness, not a directly exploitable breach: CVSS 3.1 score 3.7 with AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, requiring specific normalization and rate-limit configuration behavior; it does not grant access without an underlying weak or guessable credential. Vendor-released patch: 65.19.4. No public exploit identified at time of analysis, and no CISA KEV active-exploitation confirmation was provided.
Bypass of failed-login rate limiting in django-allauth before 65.19.4 allows unauthenticated remote attackers to obtain a higher effective number of login attempts in certain common configurations by submitting diacritic variants of the same username or email. The flaw is a low-severity defense-in-depth weakness, not a directly exploitable breach: CVSS 3.1 score 3.7 with AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, requiring specific normalization and rate-limit configuration behavior; it does not grant access without an underlying weak or guessable credential. Vendor-released patch: 65.19.4. No public exploit identified at time of analysis, and no CISA KEV active-exploitation confirmation was provided.