CVE-2026-62322: CWE-352: Cross-Site Request Forgery (CSRF) in python-social-auth social-core

The python-social-auth social-core LINE backend prior to version 5.0.2 does not validate the OAuth state parameter during the authorization code exchange. This missing validation enables a Cross-Site Request Forgery (CWE-352) attack where an attacker can initiate authorization for their own LINE account and trick a victim into visiting the callback URL. Consequently, the victim's session is logged into the attacker's LINE account. If account linking is enabled, the attacker can link their LINE identity to the victim's account, creating a persistent unauthorized access vector. This vulnerability affects only applications with the LINE backend enabled and is resolved in version 5.0.2.

An attacker can cause a victim to be logged into the attacker's LINE account without the victim's consent, potentially leading to unauthorized access or session confusion. When account linking is enabled, the attacker can link their LINE identity to the victim's account, creating a persistent unauthorized login path. There is no direct confidentiality or availability impact reported. The CVSS 3.1 base score is 6.5 (medium severity), reflecting the impact on integrity with no confidentiality or availability impact.

Upgrade python-social-auth social-core to version 5.0.2 or later, where the issue is fixed by validating the OAuth state parameter during the authorization code exchange. Applications using the LINE backend should ensure they are not running affected versions prior to 5.0.2. No other mitigations are specified.