Bug 2444764 (CVE-2026-27982) - CVE-2026-27982 django-allauth: django-allauth: Open redirect via crafted URL in SAML IdP initiated SSO
Summary: CVE-2026-27982 django-allauth: django-allauth: Open redirect via crafted URL ...
Keywords:
Status: NEW
Alias: CVE-2026-27982
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2444766 2444767
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-03-05 06:01 UTC by OSIDB Bzimport
Modified: 2026-03-05 06:15 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-03-05 06:01:34 UTC 
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL.
Note You need to log in before you can comment on or make changes to this bug.