PYSEC-2026-4167 social-auth-core has an Improper Authentication issue

Impact The SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML...

SUSE CVE-2026-57175

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could...

Linux Distros Unpatched Vulnerability : CVE-2026-57175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer...

GHSA-VQ6G-G6C7-5F2J social-auth-core has an Improper Authentication issue

Impact The SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML...

Improper Validation of Integrity Check Value

Overview social-auth-core is a package that makes Python social authentication simple. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value via the SAML authentication backend socialcore/backends/saml.py, which fails to validate SAML responses against t...

social-auth-core has an Improper Authentication issue

Impact The SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML...

DEBIAN-CVE-2026-57175

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could...

CVE-2026-57175

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could...

CVE-2026-57175 social-auth-core has an Improper Authentication issue

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could...

CVE-2026-57175

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued "AuthnRequest". Applications using SAML account association cou...

CVE-2026-57175 social-auth-core has an Improper Authentication issue

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could...

CVE-2026-57175 social-auth-core has an Improper Authentication issue

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could...

EUVD-2026-86309

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could...

CVE-2026-57175

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could...

CVE-2026-57175

The Python Social Auth SAML backend is vulnerable to an improper authentication issue prior to version 5.0.0 . The root cause is the failure to verify that SAML responses on the Assertion Consumer Service endpoint match a previously issued AuthnRequest. An attacker with a valid account on a trust...

CVE-2026-57175: Improper Authentication

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could...

PT-2026-98187

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.0.0 Description The SAML backend accepts SAML responses on the Assertion Consumer Service endpoint without verifying that they match a previously issued AuthnRequest. This flaw allows an attacker with a...

Security update for python-social-auth-app-django (moderate)

openSUSE Security Update: Security update for python-social-auth-app-django Announcement ID: openSUSE-SU-2026:0241-1 Rating: moderate References: 1251851 Cross-References: CVE-2025-61783 CVSS scores: CVE-2025-61783 SUSE: 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Affected Products: openSUSE...

Python Social Auth - Django has unsafe account association

ImpactUpon authentication, the user could be associated by e-mail even if the associatebyemail pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses. Patches...

CVE-2025-69415

In Plex Media Server PMS through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is currently associated with an account...