Vulnerability	Vulnerable Version
M Brute Force django-allauth is an integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication. Affected versions of this package are vulnerable to Brute Force in the failed login attempt rate-limiting logic, an attacker can bypass the expected brute-force protection by submitting login attempts that include diacritics (e.g., accented characters). Because diacritic variants of a username or password are handled as distinct inputs in some common configurations, each variant consumes a separate slot in the failed attempt counter, effectively multiplying the number of attempts an attacker can make before being locked out. How to fix Brute Force? Upgrade `django-allauth` to version 65.19.4 or higher.	[0.25.0,65.19.4)

Brute Force

django-allauth is an integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication.

Affected versions of this package are vulnerable to Brute Force in the failed login attempt rate-limiting logic, an attacker can bypass the expected brute-force protection by submitting login attempts that include diacritics (e.g., accented characters). Because diacritic variants of a username or password are handled as distinct inputs in some common configurations, each variant consumes a separate slot in the failed attempt counter, effectively multiplying the number of attempts an attacker can make before being locked out.

How to fix Brute Force?

Upgrade django-allauth to version 65.19.4 or higher.

[0.25.0,65.19.4)

Go back to all versions of this package