CVE-2026-115910

Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in socialcore/backends/openidconnect.py uses getandstorenonce to place the OpenID Connect nonce in a shared OpenIdConnectAssociation table, and getnonce and validateclaims verify only that...

CVE-2026-115910

The Python Social Auth library (prior to version 6.2.0 ) contains a vulnerability in social_core/backends/open_id_connect.py where the OpenID Connect nonce is not bound to the browser session. Instead of being session-specific, the nonce is stored in a shared table and validated only for existenc...