Threats affecting pkg:pypi/social-auth-core

A Cross-Site Request Forgery (CSRF) vulnerability exists in python-social-auth's social-auth-core versions 4.7.0 through before 7.0.0 in the SAML backend. This flaw allows an attacker to craft a malicious IdP response and RelayState that, when delivered to a victim's browser, signs the victim into the attacker's account, potentially capturing data entered by the victim. The issue is fixed in version 7.0.0.

The Python Social Auth library's OpenID Connect backend does not bind the nonce to the user's browser session. This allows an attacker who steals an unused authorization code to redeem it in their own browser, effectively logging in as the victim. The vulnerability arises because the nonce is stored globally in a shared association table and validated only for existence and expiration, not for session ownership. The default configuration disables PKCE, which would otherwise prevent this attack. A fix is available in version 6.2.0.