django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit.

{
                    "collectionURL": "https://pypi.org",
                    "defaultStatus": "unaffected",
                    "modules": [
                        "allauth.account.utils",
                        "allauth.account.adapter.DefaultAccountAdapter"
                    ],
                    "packageName": "django-allauth",
                    "packageURL": "pkg:pypi/django-allauth",
                    "product": "django-allauth",
                    "programFiles": [
                        "allauth/account/utils.py",
                        "allauth/account/adapter.py"
                    ],
                    "programRoutines": [
                        {
                            "name": "allauth.account.utils.filter_users_by_username()"
                        },
                        {
                            "name": "allauth.account.utils.filter_users_by_email()"
                        },
                        {
                            "name": "allauth.account.utils._unicode_ci_compare()"
                        },
                        {
                            "name": "allauth.account.adapter.DefaultAccountAdapter._get_login_attempts_cache_key()"
                        }
                    ],
                    "repo": "https://codeberg.org/allauth/django-allauth",
                    "vendor": "allauth",
                    "versions": [
                        {
                            "lessThan": "65.19.4",
                            "status": "affected",
                            "version": "0.25.0",
                            "versionType": "custom"
                        }
                    ]
                }