django-allauth releases prior to 65.19.4 do not enforce the intended limits on failed login attempts. In common configurations, the framework processes diacritic characters in user input, allowing an attacker to submit alternate forms of the same credential that bypass the limit counter, effectively raising the number of permitted attempts. As a result, an adversary could perform brute‑force or credential stuffing attacks with a higher success probability against accounts protected by django-allauth.

The vulnerability affects any installation of the django-allauth library in which the default authentication is configured to allow usernames or emails with diacritics. It applies to all prior releases of the package before version 65.19.4. Administrators should verify their current django-allauth version and any custom authentication backends that may interact with user input normalization.

The CVSS score of 3.7 indicates moderate severity, while the EPSS score is not available, suggesting limited publicly observed exploitation but still a potential risk. The vulnerability is not listed in the CISA KEV catalog. Attackers would need access to a target system’s authentication interface and the ability to supply diacritic‑enhanced credential variations, which can be achieved over the network by submitting forged HTTP requests. No elevated privileges beyond the typical attacker level are required, but the increased attack surface could lead to compromised accounts.