-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the failure of django-allauth to consistently check the is_active status of a user account during different stages of the OAuth/OIDC token lifecycle. The analysis of the patches reveals three key areas where this check was missing:
poll_device_code function did not verify the user's status before issuing tokens, allowing a deactivated user to complete the flow.RequestValidator.validate_bearer_token method failed to check if the user owning the token was active, permitting access to resources with a token belonging to a deactivated user.RequestValidator.validate_refresh_token method allowed a deactivated user to obtain new access tokens using a refresh token.The root cause is an insufficient session invalidation mechanism. Deactivating a user in the system did not automatically invalidate the authentication tokens (access and refresh) that had been previously issued to them. The provided patches fix this by adding explicit user.is_active checks at each of these critical validation points, ensuring that tokens belonging to inactive users are rejected.
poll_device_codeallauth/idp/oidc/internal/oauthlib/device_codes.py
RequestValidator.validate_bearer_tokenallauth/idp/oidc/internal/oauthlib/request_validator.py
RequestValidator.validate_refresh_tokenallauth/idp/oidc/internal/oauthlib/request_validator.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| django-allauth | pip | < 65.13.0 | 65.13.0 |
A Semantic Attack on Google Gemini - Read the Latest Research