| Package | Affected versions | Patched versions |
|---|---|---|
| django-allauth | < 65.13.0 | 65.13.0 |
| allauth | < 65.13.0 | 65.13.0 |
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free