6.2.0

Added

• Add a Weblate OpenID Connect backend with Hosted Weblate defaults, configurable
  issuer, PKCE, official branding, and optional legal-version storage.
• Add a strategy-aware backend get_title() method for sign-in labels.

Security

• Bind OpenID Connect nonces to the initiating browser session and OAuth2 state,
  rejecting authorization codes from other login attempts. In-progress OIDC
  logins must restart after upgrading.
• OpenID callbacks now require a transaction value signed into the return URL
  and stored in the initiating session. This prevents a callback from another
  browser from linking an account while a login at the same provider is pending.
  In-progress OpenID logins must restart after upgrading; unsolicited assertions
  are no longer accepted.
• Reject EVE Online sign-ins when a character's owner hash changes, preventing
  transferred characters from authenticating as the previous local user. The
  old association must be removed before the new owner can sign in.
• Enforce SOCIAL_AUTH_SLACK_TEAM against the workspace ID returned by Slack
  before login. Configurations using a workspace name or Enterprise organization
  ID must change to a workspace ID.
• Scope Mailchimp sign-in identities to both the account and the authorizing
  login, preventing different Mailchimp users on one account from sharing a
  local user. Account-keyed associations migrate only when their stored login
  identifier matches; rows without that evidence require authenticated linking
  or account recovery. Mailchimp now rejects configured ID_KEY values other
  than mailchimp_identity; remove any old user_id override before upgrading.
• Google One Tap now requires a configured client ID before validating ID
  tokens. Deployments without one must set SOCIAL_AUTH_GOOGLE_ONETAP_KEY to
  keep One Tap sign-in working.
• Reject Telegram callback fields containing a line feed before checking their
  signature, preventing one signed identity from authenticating as another UID.
• Discourse callbacks now require the session that started login, preventing
  login CSRF and unauthorized account linking. In-progress logins from before
  this upgrade, or those that lose their session, must restart.
• OAuth2 authorization starts now use distinct, session-bound, expiring states
  that are claimed once before token exchange, with PKCE verifiers kept per
  transaction. In-progress OAuth2 logins from before this upgrade must restart;
  custom storage implementations must provide atomic NonceMixin.consume().
  New abandoned session transactions are pruned on a subsequent authorization start.
• Prevent request-provided next values from resolving configuration settings
  into post-login redirects, which could disclose URL-like setting values.
• Odnoklassniki iframe logins now confirm that the signed launch's user ID
  belongs to the presented provider session, preventing account substitution
  by moving digits between undelimited signature fields.
• Reject unverified historical-identifier matches when ID_KEY is configured,
  preventing an account with a matching username from claiming a pre-6.0
  association created under a stable identifier. Existing same-identifier
  associations still re-key; deployments with older rows should review their
  stored identifier keys before changing ID_KEY settings. Compatibility UID
  hooks retain empty-key policy semantics and require an explicit opt-in for
  unverified matches when ID_KEY is configured.
• Box and ORCID no longer write access tokens into the shared
  PROFILE_EXTRA_PARAMS setting, preventing concurrent profile requests from
  using another login's token.
• Email and domain allowlists now refuse authentication and account linking
  when a provider's e-mail address is missing or malformed. Deployments using a
  global allowlist with backends that omit e-mail addresses must configure the
  provider to supply one or scope the allowlist to compatible backends.
• VK iframe app launches can no longer associate a new VK identity with the
  local user already logged in to the receiving browser. Authenticated sessions
  now accept only a VK identity already associated with that user; anonymous
  launches remain unbound and replayable as documented for the
  VK backend.
• Odnoklassniki iframe app launches can no longer associate a new OK identity
  with the local user already logged in to the receiving browser. Authenticated
  sessions now accept only an OK identity already associated with that user.
• Keep externally resumed partial pipelines bound to the local user who
  initiated them, preventing a validation link from associating its provider
  identity with a different authenticated account.
• Fixed-provider OpenID backends now require authentication to start in the
  current session and accept assertions only from the exact HTTPS provider
  endpoint discovered at that time. Previously, an attacker-controlled OpenID
  provider could complete authentication under another provider's backend name
  and, for some unmigrated legacy associations, take over an existing account.
• Generic OpenID callbacks now require backend-scoped discovery state from the
  initiating or provider-authenticated restored browser session. This prevents
  a valid assertion initiated by an attacker from being associated with a user
  in another browser session.
• Document the project's security boundaries, assumptions, downstream
  responsibilities and triage dispositions in the
  threat model.
• Correlate SAML responses with the AuthnRequest using the signed
  SubjectConfirmationData InResponseTo when the unsigned response envelope
  attribute is missing, so a solicited response cannot be replayed as
  IdP-initiated by stripping it.
• Reject the Azure AD B2C placeholder sub claims
  (Not supported currently. Use oid claim. and the legacy spelling without
  the space after the period) issued by user flows whose "Subject (sub) claim"
  setting is "Not supported", preventing every user of such a flow from being
  bound to one association. Configure
  SOCIAL_AUTH_AZUREAD_B2C_OAUTH2_ID_KEY = "oid" to use the object ID claim
  on those flows. Existing rows stored under the placeholder UID cannot be
  attributed to a specific account and should be reviewed and removed.

Changed

• Consolidate the core and Django threat models around security boundaries and
  guarantees, with operational guidance in the
  security documentation.
• Verified compatibility with Python 3.15.

Fixed

• Redact request URLs from chained HTTP and transport exception messages so
  ordinary tracebacks omit credentials in URL paths and query strings.
• OpenID Connect partial pipelines now save the validated ID token claims when
  the framework authenticates with a new backend instance, as Django does.
  Resuming previously failed with invalid_claim.
• Facebook Limited Login no longer loses its validated claims and partial resume
  authorization when the framework authenticates with a new backend instance.
• Raise structured authentication errors for missing, malformed, invalid, or
  expired VK OpenAPI callback state.
• GitHub's bad_refresh_token response now raises AuthCredentialError with
  reauthentication_required, like invalid_grant, instead of an
  AuthProviderError.