CVE-2026-126775

The Social-auth-core library (versions 4.7.0 before 7.0.0) contains a login cross-site request forgery (CSRF) vulnerability in its SAML backend . The root cause is that the backend restores sessions specified in the unsigned RelayState parameter . An attacker can exploit this by delivering a vali...

GHSA-H2R5-X5M7-3935 Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim

Summary The generic OpenID Connect backend OpenIdConnectAuth and every backend built on it stores the nonce in the shared Association table, not in the user's session. When the ID token comes back, validateclaims only checks that the nonce exists in that table and is not expired. It does not chec...

CVE-2026-115910

A flaw was found in social-auth-core. The OpenID Connect authentication backend stores nonces single-use security tokens used to prevent replay attacks in a shared table without binding them to the initiating browser session and authentication state. A remote attacker who obtains a victim's unuse...

Origin Validation Error

Overview social-auth-core is a package that makes Python social authentication simple. Affected versions of this package are vulnerable to Origin Validation Error via the validateclaims method in socialcore/backends/openidconnect.py, where a nonce stored in shared association storage is not bound...

weblate (2026.10.1) potentially affected by CVE-2026-115910 via social-auth-core (6.1.0)

social-auth-core PYPI version 6.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - weblate 2026.10.1 Source cves: CVE-2026-115910 Source advisory: MEND:CVE-2026-115910...

Security update for python-social-auth-core (important)

openSUSE Security Update: Security update for python-social-auth-core Announcement ID: openSUSE-SU-2026:0358-1 Rating: important References: 1282836 1282837 1282838 1282839 1282840 Cross-References: CVE-2026-57175 CVE-2026-57176 CVE-2026-57177 CVE-2026-57178 CVE-2026-57179 Affected Products:...

CVE-2026-62322

A flaw was found in social-auth-core. The LINE authentication backend exchanges authorization codes without validating the returned Open Authorization OAuth state parameter. A remote attacker can exploit this flaw by enticing a victim into visiting a crafted callback URL, which can log the victim...

Cross-site Request Forgery (CSRF)

Overview social-auth-core is a package that makes Python social authentication simple. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the authcomplete method in socialcore/backends/line.py the LINE OAuth2 backend, which does not call validatestate before...

argilla-server (>=1.24.0rc3, <=2.8.0), argus-notification-msteams (0.5.1) +136 more potentially affected by CVE-2026-62322 via social-auth-core (>=0.2.1, <=4.9.1)

social-auth-core PYPI version =0.2.1, =1.24.0rc3, =1.2.1, =4.14.0, =2.1.0rc1, =1.28.0rc1, =0.15.0, =1.234.0, =0.3.23, =0.8.7, =0.0.2a17, =0.1.0, =1.0.0, =2.2.0a0, =2.3.4 and more Source cves: CVE-2026-62322 Source advisory: MEND:CVE-2026-62322...

social-auth-core has a Session Fixation issue

ImpactThe partial-pipeline resume mechanism accepted partialtoken as a bearer credential without binding it to the browser session that created it.Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow, obtain a valid partial token and...

PYSEC-2026-4165 social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Impact The vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such a...

PYSEC-2026-4166 social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend

Impact The Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop coul...

PYSEC-2026-4167 social-auth-core has an Improper Authentication issue

Impact The SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML...

social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend

ImpactThe Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID.When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could...

social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

ImpactThe LoginRadius backend did not validate OAuth state during the authentication flow.Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victim...

PYSEC-2026-4168 social-auth-core has a Session Fixation issue

Impact The partial-pipeline resume mechanism accepted partialtoken as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow, obtain a valid partial token and...

social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

ImpactThe vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted.Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as...

PYSEC-2026-4169 social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

Impact The LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victi...

social-auth-core has an Improper Authentication issue

ImpactThe SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest.Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML...

Session Fixation

Overview social-auth-core is a package that makes Python social authentication simple. Affected versions of this package are vulnerable to Session Fixation via the partial pipeline resume mechanism in socialcore/utils.py and socialcore/actions.py. An attacker can resume another user's partial...