5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27982

CVE-2026-27982: django-allauth has an open redirect vulnerability

An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27982

CVE-2026-27982:

5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
django-allauth	pip	< 65.14.1	65.14.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an open redirect in the SAML IdP initiated SSO flow in django-allauth. By analyzing the commits between the last vulnerable version (65.14.0) and the first patched version (65.14.1), a security fix was identified in the allauth/socialaccount/providers/saml/utils.py file. The commit 86fff68f7b2906237ea40b1aace5020746b1e62c specifically addresses this issue. The change is within the decode_relay_state function, which is responsible for handling the RelayState parameter from the SAML authentication response. The vulnerable version of this function directly used the RelayState value as a redirect URL without validation. The patch introduces a check using get_account_adapter().is_safe_url() to ensure the URL is safe before using it for redirection, thus mitigating the open redirect vulnerability. Therefore, the decode_relay_state function is the vulnerable function.

Vulnerable functions

decode_relay_state

allauth/socialaccount/providers/saml/utils.py

The function `decode_relay_state` processes the `RelayState` parameter from a SAML response. Prior to the patch, it would directly use the value of `RelayState` as a redirection URL (`next_url`) without any validation. This allowed an attacker to provide a malicious URL in the `RelayState` parameter, causing an open redirect. The patch fixes this by adding a call to `is_safe_url` to validate the URL before assigning it to `next_url`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.