CVE-2026-27982
Description
A flaw was found in django-allauth. This open redirect vulnerability exists when Security Assertion Markup Language (SAML) Identity Provider (IdP) initiated Single Sign-On (SSO) is enabled, which is disabled by default. A remote attacker could exploit this by crafting a malicious URL, potentially redirecting users to an arbitrary external website. This could lead to information disclosure or phishing attacks.
Statement
MODERATE: This open redirect vulnerability in django-allauth affects systems where SAML IdP initiated SSO is explicitly enabled. By default, SAML IdP initiated SSO is disabled, which limits the exposure for Red Hat products. Systems with the default configuration are not affected.
Mitigation
To mitigate this vulnerability, ensure that SAML IdP initiated SSO is disabled in django-allauth. This feature is disabled by default, so no action is required if the default configuration has been maintained. If SAML IdP initiated SSO was previously enabled, disable it in your django-allauth configuration.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
The user may be redirected to an untrusted page that contains malware which may then compromise the user's system. In some cases, an open redirect can also enable the immediate download of a file without the user's permission, because the redirection to an external site may lead to endpoints on those sites that automatically trigger a download action ("drive-by download" [REF-1478]). This will expose the user to extensive risk. The user's interaction with the web server may also be compromised if the malware conducts keylogging or other attacks that steal credentials, personally identifiable information (PII), or other important data.
Access Control,Confidentiality,Other
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity; Other
By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam. The user may be subjected to phishing attacks by being redirected to an untrusted page. The phishing attack may point to an attacker controlled web page that appears to be a trusted web site. The phishers may then steal the user's credentials and then use these credentials to access the legitimate web site. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
