CVE-2026-27982: django-allauth Open Redirect Vulnerability

CVE-2026-27982 Overview

An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled. While this feature is disabled by default, when enabled, an attacker may redirect users to an arbitrary external website via a crafted URL. This type of vulnerability (CWE-601) is commonly exploited in phishing attacks to redirect unsuspecting users from legitimate domains to malicious websites.

Critical Impact

Attackers can leverage this vulnerability to redirect authenticated users to malicious websites, facilitating phishing attacks, credential theft, or malware distribution while appearing to originate from a trusted domain.

Affected Products

• django-allauth versions prior to 65.14.1
• Installations with SAML IdP initiated SSO enabled
• Python/Django web applications using vulnerable django-allauth configurations

Discovery Timeline

• 2026-03-05 - CVE CVE-2026-27982 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-27982

Vulnerability Analysis

This open redirect vulnerability affects the SAML Identity Provider (IdP) initiated Single Sign-On (SSO) functionality within django-allauth. Open redirect flaws occur when an application accepts user-controlled input that specifies a link to an external site and uses that link in a redirect without proper validation. In this case, the vulnerability allows attackers to craft URLs that, when clicked by users, will initially point to the legitimate application but redirect victims to attacker-controlled websites.

The vulnerability is particularly concerning in authentication contexts because users naturally trust redirect flows during SSO processes. When SAML IdP initiated SSO is configured, the application processes incoming assertions and redirects users to destination URLs. Without proper validation, an attacker can manipulate these redirect parameters to point to malicious external domains.

Root Cause

The root cause stems from insufficient validation of redirect URLs within the SAML SSO authentication flow. When processing SAML assertions for IdP-initiated SSO, the application fails to properly verify that redirect destinations are limited to trusted domains. This allows attackers to inject arbitrary external URLs that bypass intended access controls.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a malicious URL containing a redirect parameter pointing to an attacker-controlled website. The victim receives this link (typically via email phishing, social engineering, or compromised web content) and clicks on it. Since the URL initially appears to point to the legitimate django-allauth protected application, users may trust it.

Upon clicking, the user is initially directed to the legitimate application, which then processes the crafted redirect parameter and sends the user to the malicious external site. This can be used to harvest credentials through fake login pages, deliver malware, or conduct further social engineering attacks.

The attack typically works by appending malicious redirect parameters to legitimate SAML SSO endpoints. When users authenticate, they are unknowingly redirected to attacker-controlled domains that may mimic the original application's appearance.

Detection Methods for CVE-2026-27982

Indicators of Compromise

• Unusual redirect URLs in SAML SSO authentication logs pointing to external domains
• User complaints about unexpected website redirects after authentication attempts
• Web application logs showing redirect parameters containing external hostnames or IP addresses
• Spike in authentication events followed by immediate session terminations

Detection Strategies

• Monitor web application logs for SAML SSO requests containing suspicious redirect parameters with external domains
• Implement URL pattern matching to detect redirect parameters pointing outside the application's trusted domain list
• Deploy web application firewall (WAF) rules to flag or block requests with external redirect destinations in SAML flows
• Analyze user session patterns for authentication events immediately followed by navigation to untrusted domains

Monitoring Recommendations

• Enable detailed logging for all SAML SSO authentication events including redirect parameters
• Set up alerts for redirect URLs containing domains not on the organization's approved domain whitelist
• Monitor phishing report channels for reports of attacks leveraging the organization's domain in redirect schemes
• Regularly review authentication flow logs for anomalous patterns indicative of open redirect exploitation

How to Mitigate CVE-2026-27982

Immediate Actions Required

• Upgrade django-allauth to version 65.14.1 or later immediately
• If upgrade is not immediately possible, disable SAML IdP initiated SSO functionality until patching is complete
• Review application logs for evidence of exploitation attempts
• Notify users about potential phishing attempts leveraging the organization's domain

Patch Information

The vulnerability has been addressed in django-allauth version 65.14.1. Organizations should upgrade to this version or later to remediate the vulnerability. For detailed release information, see the Django Allauth Release Note. Additional technical details are available in the JVN Security Vulnerability Report.

Workarounds

• Disable SAML IdP initiated SSO if the feature is not required for business operations
• Implement strict URL validation at the application or web server level to only allow redirects to trusted domains
• Deploy a web application firewall (WAF) with rules to block requests containing external URLs in redirect parameters
• Configure Content Security Policy (CSP) headers with strict form-action directives to limit redirect destinations

# Example: Disable SAML IdP initiated SSO in Django settings
# In your settings.py, ensure SAML IdP initiated SSO is disabled:
SOCIALACCOUNT_PROVIDERS = {
    'saml': {
        'IDPINITIATEDSSO': {
            'ENABLED': False,  # Disable IdP initiated SSO until patched
        },
    }
}