social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Impact The vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such a...

GHSA-3C93-F73F-QC9H social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Impact The vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such a...

galaxy-app (>=23.0.1, <=24.0.3), galaxy-data (>=22.1.1, <=24.1.3) +13 more potentially affected by CVE-2026-57177 via social-auth-core (4.0.3)

social-auth-core PYPI version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy-app =23.0.1, =22.1.1, =23.0.1, =23.0.2, =21.9.0, =23.2.1, =0.4.0, =0.0.1, =0.13.0, =0.6.0, =0.1.0, =0.8.0, =0.1.0, =0.9.1...

django-globus-portal-framework (>=0.3.23, <=0.3.24), unicef-security (0.7.0) potentially affected by CVE-2026-57177 via social-auth-core (4.0.2)

social-auth-core PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - django-globus-portal-framework =0.3.23, =0.3.24 - unicef-security 0.7.0 Source cves: CVE-2026-57177 Source advisory:...

mycms (>=0.1.9, <=0.1.12) potentially affected by CVE-2026-57177 via social-auth-core (3.3.3)

social-auth-core PYPI version 3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - mycms =0.1.9, =0.1.12 Source cves: CVE-2026-57177 Source advisory: OSV:GHSA-X7QQ-23VW-7PFG...

argilla-server (>=1.24.0rc3, <=2.8.0), extralit (0.1.0a5) +2 more potentially affected by CVE-2026-57177 via social-auth-core (4.5.6)

social-auth-core PYPI version 4.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - argilla-server =1.24.0rc3, =0.2.0, =3.0.0, =3.4.0 Source cves: CVE-2026-57177 Source advisory: OSV:GHSA-X7QQ-23VW-7PFG...

umap-project (>=2.0.0a3, <=2.2.0b0) potentially affected by CVE-2026-57177 via social-auth-core (4.5.3)

social-auth-core PYPI version 4.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =2.0.0a3, =2.2.0b0 Source cves: CVE-2026-57177 Source advisory: OSV:GHSA-X7QQ-23VW-7PFG...

misago (>=0.39.0, <=0.39.6) potentially affected by CVE-2026-57177 via social-auth-core (4.5.1)

social-auth-core PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - misago =0.39.0, =0.39.6 Source cves: CVE-2026-57177 Source advisory: OSV:GHSA-X7QQ-23VW-7PFG...

umap-project (>=1.0.0rc9, <=1.0.0) potentially affected by CVE-2026-57177 via social-auth-core (3.0.0)

social-auth-core PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =1.0.0rc9, =1.0.0 Source cves: CVE-2026-57177 Source advisory: OSV:GHSA-X7QQ-23VW-7PFG...

django-auth0-user (>=0.15.0, <=0.16.5), django-rest-social-email-allauth (0.1.0) +6 more potentially affected by CVE-2026-57177 via social-auth-core (3.4.0)

social-auth-core PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - django-auth0-user =0.15.0, =3.0.0, =4.4.0a1, =0.2.0, =2.0.0, =0.0.5, =1.0.2 - social-auth-mitxpro 0.1.0 Source cves:...

argus-notification-msteams (0.5.1), argus-server (>=1.2.1, <=1.22.1) +82 more potentially affected by CVE-2026-57177 via social-auth-core (4.9.1)

social-auth-core PYPI version 4.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - argus-notification-msteams 0.5.1 - argus-server =1.2.1, =1.30.0, =1.234.0, =0.4.3, =0.8.7, =0.0.2a17, =0.1.0, =1.0.0, =2.2.0a0,...

b9gemyaeix (>=4.14.0, <=4.14.1), edx-oauth2-wordpress-backend (>=1.0.7, <=1.0.8) +15 more potentially affected by CVE-2026-57177 via social-auth-core (4.3.0)

social-auth-core PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - b9gemyaeix =4.14.0, =1.0.7, =1.0.0, =1.0.0, =1.0.0rc1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =3.5.0rc4, =4.0.0rc6,...

linhub (0.1.1) potentially affected by CVE-2026-57177 via social-auth-core (4.4.1)

social-auth-core PYPI version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - linhub 0.1.1 Source cves: CVE-2026-57177 Source advisory: OSV:GHSA-X7QQ-23VW-7PFG...

umap-project (3.1.0) potentially affected by CVE-2026-57177 via social-auth-core (4.6.1)

social-auth-core PYPI version 4.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project 3.1.0 Source cves: CVE-2026-57177 Source advisory: OSV:GHSA-X7QQ-23VW-7PFG...

Cross-site Request Forgery (CSRF)

Overview social-auth-core is a package that makes Python social authentication simple. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the LoginRadiusAuth backend in socialcore/backends/loginradius.py, which sets REDIRECTSTATE = False and STATEPARAMETER =...

GHSA-X7QQ-23VW-7PFG social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

Impact The LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victi...

umap-project (>=3.4.1, <=3.5.0) potentially affected by CVE-2026-57177 via social-auth-core (4.8.1)

social-auth-core PYPI version 4.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =3.4.1, =3.5.0 Source cves: CVE-2026-57177 Source advisory: OSV:GHSA-X7QQ-23VW-7PFG...

social-auth-liu (0.0.1) potentially affected by CVE-2026-57177 via social-auth-core (1.2.0)

social-auth-core PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - social-auth-liu 0.0.1 Source cves: CVE-2026-57177 Source advisory: OSV:GHSA-X7QQ-23VW-7PFG...

social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

Impact The LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victi...

social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend

Impact The Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop coul...