Threat database

A Cross-Site Request Forgery (CSRF) vulnerability exists in python-social-auth's social-core LINE backend prior to version 5.0.2. The vulnerability arises because the LINE backend exchanges an authorization code without validating the returned OAuth state parameter. This flaw allows an attacker to cause a victim to be logged into the attacker's LINE account or link the attacker's LINE identity to the victim's existing account when account linking is enabled. This creates a persistent unauthorized login path. The issue is fixed in version 5.0.2.

CVE-2026-57179 is a session fixation vulnerability in python-social-auth's social-core component affecting versions prior to 5.0.0. The issue arises because the partial-pipeline resume mechanism accepted a partial token as a bearer credential without binding it to the originating browser session. This flaw could allow an attacker to initiate an authentication flow, obtain a valid partial token, and trick a victim's browser into resuming the attacker's authentication flow, effectively authenticating the victim as the attacker. The vulnerability affects applications using partial pipeline steps such as mail_validation or custom steps decorated with @partial. The issue was fixed in version 5.0.0 by binding partial pipeline resumes to the originating browser session.

Python Social Auth's social-core component prior to version 5.0.0 contains an improper authentication vulnerability in the vk-app backend. The backend accepted VK application callback data without verifying the callback signature if the auth_key parameter was missing. This allowed attackers to impersonate arbitrary VK user identities by manipulating callback fields. The issue is fixed in version 5.0.0 by enforcing the presence and validity of auth_key before trusting callback data.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the LoginRadius backend of python-social-auth's social-core component prior to version 5.0.0. This flaw allows an attacker to trick a victim's browser into completing an authentication process using an attacker-controlled LoginRadius token, effectively logging the victim in as the attacker. The vulnerability is fixed in version 5.0.0 by enabling OAuth state validation during the authentication flow.

CVE-2026-57176 is an authentication bypass vulnerability in python-social-auth's social-core component affecting the Vend OAuth2 backend prior to version 5.0.0. The issue arises when multiple Vend shops authenticate through the same application, causing user ID collisions due to reliance on numeric Vend user_id as the social-auth UID. This allows a user from one shop to be authenticated as a different local account associated with the same numeric user ID from another shop. The vulnerability is patched in version 5.0.0.

CVE-2026-57175 is an improper authentication vulnerability in python-social-auth's social-core SAML backend prior to version 5.0.0. The flaw allows acceptance of SAML responses without verifying they match a previously issued AuthnRequest. This can enable an attacker with a valid identity on a trusted Identity Provider (IdP) to link their SAML identity to a victim's local account and gain unauthorized access. The issue affects applications using the SAML backend with authenticated account association and was fixed in version 5.0.0 by validating SAML responses against stored AuthnRequest IDs.

Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses. Version 5.6.0 contains a patch. As a workaround, review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.