Threats tagged 'ghsa-33vc-vcr3-vj5p'

Social-auth-core versions from 4.7.0 up to but not including 7.0.0 contain a login cross-site request forgery (CSRF) vulnerability in the SAML backend. This flaw allows attackers to craft a valid Identity Provider (IdP) response and RelayState parameter that is unsigned, which can be delivered to a victim's browser via an auto-submitting form. Exploitation results in the victim being logged into the attacker's account, enabling the attacker to capture any data the victim enters during the session.