django-allauth User Token Handling Vulnerability Leading to Inactive Account Bypass

A vulnerability exists in django-allauth versions prior to 65.13.0, where marking a user as inactive after tokens had been issued while the account was active did not take effect. This allowed for tokens to remain valid despite the account status change. The issue has been addressed in version 65.13.0, where tokens are now properly rejected if the user's account is marked as inactive.

Impact

Exploitation of this vulnerability allowed for access and refresh tokens to remain valid even after a user's account was marked inactive, potentially leading to unauthorized access.

Remediation

Users can upgrade to django-allauth version 65.13.0 or later to address this vulnerability.