CVE-2026-27982: 
Python vulnerability analysis and mitigation

CVE-2026-27982 is an open redirect vulnerability in django-allauth that exists when SAML Identity Provider (IdP) initiated Single Sign-On (SSO) is enabled — a feature that is disabled by default. A remote attacker can exploit this by crafting a malicious URL to redirect users to an arbitrary external website, potentially enabling phishing attacks or information disclosure. All versions of django-allauth prior to 65.14.1 are affected. The vulnerability was published on March 5, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site / Open Redirect). When SAML IdP-initiated SSO is enabled in django-allauth, the application fails to adequately validate the redirect URL provided in the SAML response or associated request parameters, allowing an attacker to supply an arbitrary external URL. Exploitation requires no privileges and no authentication, but does require user interaction — a victim must follow the crafted link. No public proof-of-concept code has been identified at this time (Red Hat Advisory, JVN Advisory).

Successful exploitation could redirect authenticated users to attacker-controlled external websites, facilitating credential phishing, session token theft, or delivery of malware through fake login pages that appear to originate from a trusted application. The confidentiality and integrity impacts are low in scope, with no direct availability impact; however, the changed scope metric reflects that the impact extends beyond the vulnerable component to the user's browser environment. The risk is most significant in deployments where SAML IdP-initiated SSO is actively enabled and users are likely to trust redirect flows from the application (Red Hat Advisory, ENISA EUVD).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time. The EPSS score is approximately 0.03%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is limited to configurations where SAML IdP-initiated SSO is explicitly enabled, which is not the default setting, further reducing the attack surface (Red Hat Advisory, JVN Advisory).

1. Reconnaissance: Identify web applications using django-allauth with SAML IdP-initiated SSO enabled (versions prior to 65.14.1). This can be done by probing SAML-related endpoints or reviewing publicly accessible application metadata.
2. Craft malicious URL: Construct a URL targeting the SAML IdP-initiated SSO endpoint of the vulnerable application, embedding a redirect parameter pointing to an attacker-controlled external site (e.g., https://target.example.com/accounts/saml/<provider>/acs/?RelayState=https://evil.example.com).
3. Deliver to victim: Send the crafted URL to a target user via phishing email, social media, or other social engineering channels, leveraging the trusted domain of the legitimate application to increase click-through likelihood.
4. Redirect and harvest: When the victim clicks the link and the SAML flow completes, the application redirects the user to the attacker's external site, where credentials or session tokens can be harvested via a fake login page (JVN Advisory, Red Hat Advisory).

• Network: HTTP requests to SAML ACS (Assertion Consumer Service) endpoints (e.g., /accounts/saml/<provider>/acs/) containing RelayState parameters with external or suspicious URLs; outbound redirects (HTTP 302) from the application server to non-whitelisted external domains.
• Logs: Web server or application access logs showing SAML endpoint requests with RelayState values pointing to external domains; repeated requests from the same source IP with varying external redirect targets.
• Application: Django application logs recording SAML authentication flows that terminate in redirects to unexpected external URLs.

The primary remediation is to upgrade django-allauth to version 65.14.1 or later, which resolves the open redirect issue (allauth release notes). For deployments that do not require SAML IdP-initiated SSO, keeping this feature disabled (the default) fully prevents exploitation. As an additional defense-in-depth measure, implement server-side URL validation to restrict post-authentication redirects to a whitelist of trusted domains, and consider adding a redirect warning page for any external links (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability was reported through Japan's JVN (Japan Vulnerability Notes) coordination process and assigned identifier JVN#23669411, indicating coordinated disclosure with the django-allauth maintainers (JVN Advisory). Red Hat tracked the issue via their security response process and Bugzilla. No significant broader media coverage or notable researcher commentary beyond standard advisory publication has been observed for this moderate-severity vulnerability.