CVE-2025-65430: 
Python vulnerability analysis and mitigation

CVE-2025-65430 is an insufficient session expiration vulnerability in django-allauth (allauth-django) where deactivated user accounts retain valid OAuth/IdP access and refresh tokens. When a user is marked as is_active=False after tokens have already been issued, those tokens are not invalidated and continue to grant access. All versions of django-allauth before 65.13.0 are affected. The vulnerability was published on December 15, 2025, and carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory).

The root cause is classified as CWE-613 (Insufficient Session Expiration). In django-allauth's Identity Provider (IdP) integration, the token validation logic did not check the is_active status of the associated user when evaluating access or refresh tokens. As a result, tokens issued while an account was active remained valid even after an administrator set is_active=False, bypassing the intended account deactivation control. The fix, introduced in version 65.13.0 via commits 39f4a4c and c54edf9, ensures that both access and refresh tokens are rejected for users whose accounts have been deactivated (GitHub Advisory).

A deactivated user (or an attacker who has obtained that user's tokens) can continue to authenticate and perform actions on the application as if the account were still active. This results in low confidentiality and integrity impacts — the attacker can read and potentially modify data accessible to the deactivated account. Availability is not affected. The risk is most significant in scenarios where accounts are deactivated due to compromise or termination, as the intended security control (account deactivation) fails to revoke existing sessions (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. Exploitation requires low-privilege access — specifically, possession of a valid access or refresh token issued before account deactivation. The EPSS score is approximately 0.025–0.039%, placing it in the 12th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Obtain tokens: An attacker (or a deactivated user) possesses valid access and/or refresh tokens previously issued by the django-allauth IdP while the account was active.
2. Account deactivation occurs: An administrator sets the user's is_active=False in Django, intending to revoke access.
3. Reuse tokens: The attacker submits the previously issued access token in API requests to the application. On unpatched versions, the token validation does not check is_active, so the request is accepted.
4. Refresh access: If the access token expires, the attacker uses the refresh token to obtain a new access token, continuing unauthorized access indefinitely until tokens naturally expire.
5. Achieve objective: The attacker reads sensitive data or performs actions permitted by the deactivated account's privileges (GitHub Advisory).

• Logs: Authentication or API access log entries showing successful requests from tokens belonging to users whose is_active field is False in the Django database; look for successful HTTP 200 responses on protected endpoints from accounts that should be deactivated.
• Application Events: Django admin audit logs showing a user set to is_active=False followed by continued successful API activity from that user's token.
• Database: Cross-reference active OAuth tokens in the allauth token tables against users where auth_user.is_active = 0 (or False) to identify orphaned valid tokens.

Upgrade django-allauth to version 65.13.0 or later, which rejects access and refresh tokens for users with is_active=False (GitHub Advisory, allauth release notes). As an interim workaround for organizations unable to upgrade immediately: manually revoke all tokens in the allauth token tables for any user being deactivated, implement additional middleware to validate is_active on each authenticated request, and audit existing deactivated accounts for lingering valid tokens. Regularly rotating tokens and setting short token expiry windows will also reduce the window of exposure.