p PatchFirst

PatchFirst · Latest vulnerabilities

social-auth-core vulnerabilities

Vulnerabilities published for social-auth-core in the last 30 days: 6. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 6

  1. CVE-2026-62322

    Medium · CVSS 6.5EPSS 0.15%Fix available

    Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

    Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resulting callback URL, causing the application to log the victim into the attacker's account. When account linking is enabled, the same missing validation can link the attacker's LINE identity to the victim's existing account and create a persistent unauthorized login path. Only applications with the LINE backend enabled are affected. This issue is fixed in

    social-auth-corePython
    • Update to 5.0.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-57179

    Medium · CVSS 4.2EPSS 0.16%Fix available

    social-auth-core has a Session Fixation issue

    Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted `partial_token` as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow, obtain a valid partial token and verification data, and cause a victim's browser to resume that attacker-controlled flow. This could authenticate the victim's browser as the attacker's account. The issue affects applications using partial pipeline steps such as `mail_validation` or custom steps decora

    social-auth-corePython
    • Update to 5.0.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  3. CVE-2026-57178

    High · CVSS 7.4EPSS 0.16%Fix available

    social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

    Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the `vk-app` backend accepted VK application callback data without verifying the callback signature when the `auth_key` parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as `viewer_id`, `access_token`, `api_id`, and `api_result`, potentially allowing authentication as an arbitrary VK user ID. The issue affects only applications using the `vk-app` backend. The issue has been fixed in version 5.0.0 by requiring `auth_key` to be pr

    social-auth-corePython
    • Update to 5.0.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2026-57177

    Medium · CVSS 4.3EPSS 0.11%Fix available

    social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

    Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victim authenticated as the attacker's LoginRadius identity. The issue affects only applications using the LoginRadius backend. The issue has been fixe in version 5.0.0 by enabling callback state validation for the LoginRadius backend.

    social-auth-corePython
    • Update to 5.0.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2026-57176

    Medium · CVSS 6.8EPSS 0.22%Fix available

    social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend

    Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop. The issue affects applications using the Vend OAuth2 backend with more than one Vend shop. Version 5.0.0 patches the issue.

    social-auth-corePython
    • Update to 5.0.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2026-57175

    Medium · CVSS 6.4EPSS 0.23%Fix available

    social-auth-core has an Improper Authentication issue

    Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued `AuthnRequest`. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML identity to a logged-in victim's local account. The attacker could then authenticate through SAML and gain access to the victim's account. The issue affects applications using the SAML backend together with authenticated account association. The issue has been fixed

    social-auth-corePython
    • Update to 5.0.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →