CVE-2026-97764 Overview
CVE-2026-97764 affects django-allauth versions before 65.19.4, a widely used authentication library for Django applications. The library fails to enforce expected limits on failed login attempts in certain common configurations. Attackers can leverage the handling of diacritics such as accented characters to achieve a higher effective rate limit than intended. This weakness falls under [CWE-180: Incorrect Behavior Order: Validate Before Canonicalize], where input normalization occurs after rate-limit evaluation.
Critical Impact
Attackers can exceed configured login attempt thresholds by varying diacritic forms of usernames, weakening brute-force protections on affected django-allauth deployments.
Affected Products
- django-allauth versions prior to 65.19.4
- Django applications using django-allauth for authentication with default rate-limiting configurations
- Deployments relying on django-allauth account login throttling
Discovery Timeline
- 2026-09-25 - CVE-2026-97764 published to NVD
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-97764
Vulnerability Analysis
The vulnerability resides in how django-allauth tracks failed login attempts against usernames or email identifiers. The rate limiter keys attempts by the raw submitted identifier string rather than by a canonicalized form. Characters with diacritics, such as é, ñ, or ü, produce distinct keys from their ASCII equivalents even when they resolve to the same user account during authentication.
An attacker targeting a user named admin can submit variants like admín, ädmin, or admīn. Each variant creates a separate rate-limit counter while the backend may still resolve the request to the same account. This expands the effective attempt budget, enabling credential-guessing attacks beyond intended thresholds.
Root Cause
The root cause is improper ordering of validation and canonicalization operations. The library evaluates rate-limit state before normalizing identifier strings to a canonical Unicode form. This creates divergence between the rate-limit namespace and the account-lookup namespace. Fixes landed in commits 4379e79, 4e252aa, and ae47277, which align rate-limit keying with normalized identifier handling.
Attack Vector
Exploitation requires network access to the authentication endpoint and does not require prior privileges or user interaction. An attacker enumerates diacritic variants of a known or guessed username and distributes failed login attempts across those variants. The attack complexity is high because the attacker must identify a configuration where Unicode-insensitive account resolution coexists with Unicode-sensitive rate-limit keying. Confidentiality impact is none directly; integrity impact is low through increased likelihood of successful password guessing.
No verified public exploit code is available. See the django-allauth commits for the upstream fix.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-97764
Indicators of Compromise
- Repeated failed login attempts for the same logical account using identifiers that differ only in diacritic characters.
- Authentication log entries showing elevated failed-attempt volume originating from a single source IP against varied Unicode-normalized forms of a username.
- Successful logins following bursts of near-identical username variants.
Detection Strategies
- Normalize usernames to NFKC form in log aggregation pipelines and group failed authentication attempts by the normalized value.
- Correlate failed authentication events across diacritic variants over sliding time windows to identify distributed brute-force patterns.
- Alert when the ratio of distinct raw identifiers to distinct normalized identifiers exceeds a baseline threshold per source IP.
Monitoring Recommendations
- Ingest django-allauth authentication logs into a centralized SIEM with Unicode-aware parsing.
- Track per-account failed login velocity using canonicalized identifiers rather than raw submitted strings.
- Monitor the installed django-allauth version across application inventories and flag instances below 65.19.4.
How to Mitigate CVE-2026-97764
Immediate Actions Required
- Upgrade django-allauth to version 65.19.4 or later across all Django deployments.
- Audit authentication logs for diacritic-variant login patterns against privileged accounts.
- Force password resets for accounts showing evidence of distributed brute-force activity.
Patch Information
The fix is included in django-allauth 65.19.4, available from the django-allauth PyPI package. The upstream fixes are documented in commits 4379e79, 4e252aa, and ae47277. Review the Allauth release notes for configuration guidance.
Workarounds
- Deploy a reverse proxy or Web Application Firewall rule that normalizes usernames to NFKC form before forwarding authentication requests.
- Enforce per-source-IP request rate limits at the network edge independent of application-layer throttling.
- Require multi-factor authentication on all accounts to reduce the impact of credential-guessing attempts.
# Upgrade django-allauth to the patched release
pip install --upgrade 'django-allauth>=65.19.4'
# Verify installed version
pip show django-allauth | grep Version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
