CVE-2025-65430
An issue was discovered in allauth-django before 65.13.0.
Published Dec 15, 2025 · updated Oct 14, 2026 · allauth allauth
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Dec 15, 2025 · NIST NVD
Detected
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.
Oct 14, 2026 · NIST NVD
Updated
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.
Affected
- cpe allauth/allauthversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2025-65430
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2025-65430
30-day exploitation probability 0.2%
first.org - NIST NVDVulnerability recordCVE-2025-65430
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.
nvd.nist.gov