Threat Intelligence Database

A Cross-Site Request Forgery (CSRF) vulnerability exists in python-social-auth's social-core LINE backend prior to version 5.0.2. The vulnerability arises because the LINE backend exchanges an authorization code without validating the returned OAuth state parameter. This flaw allows an attacker to cause a victim to be logged into the attacker's LINE account or link the attacker's LINE identity to the victim's existing account when account linking is enabled. This creates a persistent unauthorized login path. The issue is fixed in version 5.0.2.

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted `partial_token` as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow, obtain a valid partial token and verification data, and cause a victim's browser to resume that attacker-controlled flow. This could authenticate the victim's browser as the attacker's account. The issue affects applications using partial pipeline steps such as `mail_validation` or custom steps decorated with `@partial`. The issue has been fixed in version 5.0.0 by binding partial pipeline resumes to the originating browser session.

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the `vk-app` backend accepted VK application callback data without verifying the callback signature when the `auth_key` parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as `viewer_id`, `access_token`, `api_id`, and `api_result`, potentially allowing authentication as an arbitrary VK user ID. The issue affects only applications using the `vk-app` backend. The issue has been fixed in version 5.0.0 by requiring `auth_key` to be present and valid before callback data is trusted.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the python-social-auth social-core LoginRadius backend prior to version 5.0.0. The backend did not validate the OAuth state parameter during authentication, allowing an attacker to force a victim's browser to authenticate using the attacker's LoginRadius token. This could cause the victim to be logged in as the attacker. The vulnerability affects only applications using the LoginRadius backend and was fixed in version 5.0.0 by enabling callback state validation.

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop. The issue affects applications using the Vend OAuth2 backend with more than one Vend shop. Version 5.0.0 patches the issue.

CVE-2026-57175 is an improper authentication vulnerability in python-social-auth's social-core SAML backend prior to version 5.0.0. The flaw allows SAML responses to be accepted without verifying they correspond to a previously issued AuthnRequest. This enables an attacker with a valid identity on a trusted Identity Provider to link their SAML identity to a victim's local account and gain unauthorized access. The issue affects applications using the SAML backend with authenticated account association. The vulnerability is fixed in version 5.0.0 by validating SAML responses against stored AuthnRequest IDs.