MEDIUM5.4

PYSEC-2025-110

Quick fix

PYSEC-2025-110 — django-allauth: upgrade to the fixed version with the command below.

pip install --upgrade 'django-allauth>=65.13.0'

Details

An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/django-allauth

Introduced in: 0Fixed in: 65.13.0

Fixpip install --upgrade 'django-allauth>=65.13.0'

References

https://allauth.org/news/2025/10/django-allauth-65.13.0-released/[ADVISORY]
https://github.com/advisories/GHSA-qhmc-3mvr-f2j4[ADVISORY]