CVE-2026-97764

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97764", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-09-25T04:25:57.123Z", "datePublished": "2026-09-25T04:25:57.932Z", "dateUpdated": "2026-09-25T13:37:50.367Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://pypi.org", "defaultStatus": "unaffected", "modules": ["allauth.account.utils", "allauth.account.adapter.DefaultAccountAdapter"], "packageName": "django-allauth", "packageURL": "pkg:pypi/django-allauth", "product": "django-allauth", "programFiles": ["allauth/account/utils.py", "allauth/account/adapter.py"], "programRoutines": [{"name": "allauth.account.utils.filter_users_by_username()"}, {"name": "allauth.account.utils.filter_users_by_email()"}, {"name": "allauth.account.utils._unicode_ci_compare()"}, {"name": "allauth.account.adapter.DefaultAccountAdapter._get_login_attempts_cache_key()"}], "repo": "https://codeberg.org/allauth/django-allauth", "vendor": "allauth", "versions": [{"lessThan": "65.19.4", "status": "affected", "version": "0.25.0", "versionType": "custom"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "1. Any of the following settings is enabled in Django configuration.<br> <br><span style=\"background-color: rgb(255, 255, 255)\">65.4&nbsp;</span><span style=\"background-color: rgb(255, 255, 255)\">and later:<br></span>ACCOUNT_LOGIN_METHODS = {\"username\", \"email\"}<br>ACCOUNT_LOGIN_METHODS = {\"username\"}<br><span style=\"background-color: rgb(255, 255, 255)\"><br>65.3 and earlier:</span><br><span style=\"background-color: rgb(255, 255, 255)\"><span style=\"background-color: rgb(255, 255, 255)\">ACCOUNT_AUTHENTICATION_METHOD = \"username_email\"</span><br>ACCOUNT_AUTHENTICATION_METHOD = \"username\"<br><br></span>2. The username column in the database uses a collation such as utf8mb4_general_ci or utf8mb4_unicode_ci.<br><br>"}], "value": "1. Any of the following settings is enabled in Django configuration.\n \n65.4\u00a0and later:\nACCOUNT_LOGIN_METHODS = {\"username\", \"email\"}\nACCOUNT_LOGIN_METHODS = {\"username\"}\n\n65.3 and earlier:\nACCOUNT_AUTHENTICATION_METHOD = \"username_email\"\nACCOUNT_AUTHENTICATION_METHOD = \"username\"\n\n2. The username column in the database uses a collation such as utf8mb4_general_ci or utf8mb4_unicode_ci."}], "descriptions": [{"lang": "en", "value": "django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-180", "description": "CWE-180 Incorrect Behavior Order: Validate Before Canonicalize", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-25T04:25:57.932Z"}, "references": [{"tags": ["release-notes"], "url": "https://docs.allauth.org/en/latest/release-notes/recent.html"}, {"tags": ["product"], "url": "https://pypi.org/project/django-allauth/"}, {"tags": ["patch"], "url": "https://codeberg.org/allauth/django-allauth/commit/4379e7931fe7572aacc4f3b4b5f2298d5f3ecc96"}, {"tags": ["patch"], "url": "https://codeberg.org/allauth/django-allauth/commit/4e252aa2be7cef5d72d78049d6fb07cb27a89c83"}, {"tags": ["technical-description", "related"], "url": "https://codeberg.org/allauth/django-allauth/commit/ae472772c8f93bcb972205c9d7159051cf6f413a"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade django-allauth to version 65.19.4 (latest). <br>"}], "value": "Upgrade django-allauth to version 65.19.4 (latest)."}], "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The vulnerability is NOT exposed if any of the following settings is enabled.<br><br><span style=\"background-color: rgb(255, 255, 255)\">65.4 </span><span style=\"background-color: rgb(255, 255, 255)\">and later:</span><br>ACCOUNT_LOGIN_METHODS = {\"email\"}<br><br>65.3 and earlier:<br>ACCOUNT_AUTHENTICATION_METHOD = \"email\"<br>"}], "value": "The vulnerability is NOT exposed if any of the following settings is enabled.\n\n65.4 and later:\nACCOUNT_LOGIN_METHODS = {\"email\"}\n\n65.3 and earlier:\nACCOUNT_AUTHENTICATION_METHOD = \"email\""}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-25T13:37:23.042548Z", "id": "CVE-2026-97764", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-25T13:37:50.367Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97764", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-09-25T04:25:57.123Z", "datePublished": "2026-09-25T04:25:57.932Z", "dateUpdated": "2026-09-25T13:37:50.367Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://pypi.org", "defaultStatus": "unaffected", "modules": ["allauth.account.utils", "allauth.account.adapter.DefaultAccountAdapter"], "packageName": "django-allauth", "packageURL": "pkg:pypi/django-allauth", "product": "django-allauth", "programFiles": ["allauth/account/utils.py", "allauth/account/adapter.py"], "programRoutines": [{"name": "allauth.account.utils.filter_users_by_username()"}, {"name": "allauth.account.utils.filter_users_by_email()"}, {"name": "allauth.account.utils._unicode_ci_compare()"}, {"name": "allauth.account.adapter.DefaultAccountAdapter._get_login_attempts_cache_key()"}], "repo": "https://codeberg.org/allauth/django-allauth", "vendor": "allauth", "versions": [{"lessThan": "65.19.4", "status": "affected", "version": "0.25.0", "versionType": "custom"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "1. Any of the following settings is enabled in Django configuration.<br> <br><span style=\"background-color: rgb(255, 255, 255)\">65.4&nbsp;</span><span style=\"background-color: rgb(255, 255, 255)\">and later:<br></span>ACCOUNT_LOGIN_METHODS = {\"username\", \"email\"}<br>ACCOUNT_LOGIN_METHODS = {\"username\"}<br><span style=\"background-color: rgb(255, 255, 255)\"><br>65.3 and earlier:</span><br><span style=\"background-color: rgb(255, 255, 255)\"><span style=\"background-color: rgb(255, 255, 255)\">ACCOUNT_AUTHENTICATION_METHOD = \"username_email\"</span><br>ACCOUNT_AUTHENTICATION_METHOD = \"username\"<br><br></span>2. The username column in the database uses a collation such as utf8mb4_general_ci or utf8mb4_unicode_ci.<br><br>"}], "value": "1. Any of the following settings is enabled in Django configuration.\n \n65.4\u00a0and later:\nACCOUNT_LOGIN_METHODS = {\"username\", \"email\"}\nACCOUNT_LOGIN_METHODS = {\"username\"}\n\n65.3 and earlier:\nACCOUNT_AUTHENTICATION_METHOD = \"username_email\"\nACCOUNT_AUTHENTICATION_METHOD = \"username\"\n\n2. The username column in the database uses a collation such as utf8mb4_general_ci or utf8mb4_unicode_ci."}], "descriptions": [{"lang": "en", "value": "django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-180", "description": "CWE-180 Incorrect Behavior Order: Validate Before Canonicalize", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-25T04:25:57.932Z"}, "references": [{"tags": ["release-notes"], "url": "https://docs.allauth.org/en/latest/release-notes/recent.html"}, {"tags": ["product"], "url": "https://pypi.org/project/django-allauth/"}, {"tags": ["patch"], "url": "https://codeberg.org/allauth/django-allauth/commit/4379e7931fe7572aacc4f3b4b5f2298d5f3ecc96"}, {"tags": ["patch"], "url": "https://codeberg.org/allauth/django-allauth/commit/4e252aa2be7cef5d72d78049d6fb07cb27a89c83"}, {"tags": ["technical-description", "related"], "url": "https://codeberg.org/allauth/django-allauth/commit/ae472772c8f93bcb972205c9d7159051cf6f413a"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade django-allauth to version 65.19.4 (latest). <br>"}], "value": "Upgrade django-allauth to version 65.19.4 (latest)."}], "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The vulnerability is NOT exposed if any of the following settings is enabled.<br><br><span style=\"background-color: rgb(255, 255, 255)\">65.4 </span><span style=\"background-color: rgb(255, 255, 255)\">and later:</span><br>ACCOUNT_LOGIN_METHODS = {\"email\"}<br><br>65.3 and earlier:<br>ACCOUNT_AUTHENTICATION_METHOD = \"email\"<br>"}], "value": "The vulnerability is NOT exposed if any of the following settings is enabled.\n\n65.4 and later:\nACCOUNT_LOGIN_METHODS = {\"email\"}\n\n65.3 and earlier:\nACCOUNT_AUTHENTICATION_METHOD = \"email\""}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-97764", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-25T13:37:23.042548Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-25T13:37:42.586Z"}}]}}

{"affected": [{"affectedData": [{"collectionURL": "https://pypi.org", "defaultStatus": "unaffected", "modules": ["allauth.account.utils", "allauth.account.adapter.DefaultAccountAdapter"], "packageName": "django-allauth", "packageURL": "pkg:pypi/django-allauth", "product": "django-allauth", "programFiles": ["allauth/account/utils.py", "allauth/account/adapter.py"], "programRoutines": [{"name": "allauth.account.utils.filter_users_by_username()"}, {"name": "allauth.account.utils.filter_users_by_email()"}, {"name": "allauth.account.utils._unicode_ci_compare()"}, {"name": "allauth.account.adapter.DefaultAccountAdapter._get_login_attempts_cache_key()"}], "repo": "https://codeberg.org/allauth/django-allauth", "vendor": "allauth", "versions": [{"lessThan": "65.19.4", "status": "affected", "version": "0.25.0", "versionType": "custom"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit."}], "id": "CVE-2026-97764", "lastModified": "2026-09-30T17:32:07.107", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-97764", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-25T13:37:23.042548Z", "version": "2.0.3"}}]}, "published": "2026-09-25T05:17:07.953", "references": [{"source": "cve@mitre.org", "url": "https://codeberg.org/allauth/django-allauth/commit/4379e7931fe7572aacc4f3b4b5f2298d5f3ecc96"}, {"source": "cve@mitre.org", "url": "https://codeberg.org/allauth/django-allauth/commit/4e252aa2be7cef5d72d78049d6fb07cb27a89c83"}, {"source": "cve@mitre.org", "url": "https://codeberg.org/allauth/django-allauth/commit/ae472772c8f93bcb972205c9d7159051cf6f413a"}, {"source": "cve@mitre.org", "url": "https://docs.allauth.org/en/latest/release-notes/recent.html"}, {"source": "cve@mitre.org", "url": "https://pypi.org/project/django-allauth/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-180"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.25.0,65.19.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "django-allauth", "source": "cna", "vendor": "allauth"}, "product": "django-allauth", "vendor": "allauth"}], "created": "2026-09-25T06:00:12.649972+00:00", "title": "Login Attempt Limit Bypass via Diacritic Handling", "updated": "2026-09-25T09:00:14.760025+00:00", "vendors": ["allauth", "allauth$PRODUCT$django-allauth"]}