Executive brief
django-allauth, a popular authentication package for Django web applications, contains a security flaw in its SAML login feature. If the SAML identity provider (IdP) initiated login is enabled, an attacker can trick users into visiting a malicious website by using a specially crafted link. This could be used in phishing campaigns to steal user credentials or distribute malware by making a malicious site appear to be part of a trusted application.
Technical details
An open redirect vulnerability (CWE-601) exists in django-allauth when SAML IdP-initiated Single Sign-On (SSO) is enabled. The vulnerability stems from the application's failure to validate the 'RelayState' parameter in SAML requests, which is used to determine the destination URL after a successful login. A remote, unauthenticated attacker can craft a URL containing a malicious external site in the RelayState parameter; if a user clicks this link and authenticates, they will be redirected to the attacker-controlled domain. This issue is patched in version 65.14.1. Note that SAML IdP-initiated SSO is disabled by default in standard configurations.
Affected products
- allauth django-allauth < 65.14.1
Timeline
- 2026-02-07: patched: Version 65.14.1 released
- 2026-03-05: disclosed: Initial public disclosure and CVE assignment