Authentication Bypass via Diacritic Handling in django-allauth

Executive Summary

django-allauth before version 65.19.4 has a flaw in its authentication system where failed login attempts are not properly limited. This happens because usernames or emails with diacritics (like accents) can bypass rate limits by creating multiple keys for a single account. For example, 'admin' and 'ádmin' might be treated as different accounts during login attempts.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if you are using django-allauth versions up to 65.19.4. Inspect authentication logs for multiple failed login attempts from the same account using variations with diacritics (e.g., 'admin' vs 'ádmin'). Ensure your AUTHENTICATION_BACKENDS does not include Django’s ModelBackend if using username authentication.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to repeatedly attempt logging into your account without triggering rate limits. This increases the risk of brute-force attacks, potentially allowing unauthorized access if weak passwords are used. Systems relying on django-allauth for authentication may face higher security risks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by weakening authentication security. Bypassing rate limits may allow unauthorized access attempts to go undetected, increasing the risk of data breaches or unauthorized data access. GDPR requires strong security measures to protect personal data, while HIPAA mandates strict access controls for protected health information. The vulnerability undermines these requirements by enabling attackers to circumvent login attempt limits.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade django-allauth to version 65.19.4 or later. If using username authentication, remove Django’s ModelBackend from AUTHENTICATION_BACKENDS. Review authentication logs for suspicious activity and enforce stricter rate limits on login attempts.

Useful 0 Not Useful 0