EUVD-2026-86310

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Ven...

CVE-2026-57176

The Python Social Auth library is vulnerable to account takeover in its Vend OAuth2 backend prior to version 5.0.0 . The root cause is an identity binding flaw where the backend uses only the numeric user_id as the social-auth UID. When multiple Vend shops are integrated into the same application...