social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

Impact The LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victi...

GHSA-X7QQ-23VW-7PFG social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

Impact The LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victi...

Cross-site Request Forgery (CSRF)

Overview social-auth-core is a package that makes Python social authentication simple. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the LoginRadiusAuth backend in socialcore/backends/loginradius.py, which sets REDIRECTSTATE = False and STATEPARAMETER =...

social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend

Impact The Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop coul...

GHSA-FP7W-M676-W7GC social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend

Impact The Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop coul...

Authentication Bypass by Alternate Name

Overview social-auth-core is a package that makes Python social authentication simple. Affected versions of this package are vulnerable to Authentication Bypass by Alternate Name via the getuserid method in the Vend OAuth2 backend socialcore/backends/vend.py, where user identifiers are scoped onl...

umap-project (3.1.0) potentially affected by CVE-2026-57175 via social-auth-core (4.6.1)

social-auth-core PYPI version 4.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project 3.1.0 Source cves: CVE-2026-57175 Source advisory: OSV:GHSA-VQ6G-G6C7-5F2J...

galaxy-data (>=20.9.1, <=21.9.0), umap-project (>=1.2.0, <=1.2.1) potentially affected by CVE-2026-57175 via social-auth-core (3.3.0)

social-auth-core PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy-data =20.9.1, =1.2.0, =1.2.1 Source cves: CVE-2026-57175 Source advisory: OSV:GHSA-VQ6G-G6C7-5F2J...

linhub (0.1.1) potentially affected by CVE-2026-57175 via social-auth-core (4.4.1)

social-auth-core PYPI version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - linhub 0.1.1 Source cves: CVE-2026-57175 Source advisory: OSV:GHSA-VQ6G-G6C7-5F2J...

netbox-types (>=4.5.4, <=4.6.5), umap-project (>=3.6.2, <=3.7.3) potentially affected by CVE-2026-57175 via social-auth-core (4.8.5)

social-auth-core PYPI version 4.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - netbox-types =4.5.4, =3.6.2, =3.7.3 Source cves: CVE-2026-57175 Source advisory: OSV:GHSA-VQ6G-G6C7-5F2J...

umap-project (>=2.0.0a0, <=2.0.0a2) potentially affected by CVE-2026-57175 via social-auth-core (4.5.2)

social-auth-core PYPI version 4.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =2.0.0a0, =2.0.0a2 Source cves: CVE-2026-57175 Source advisory: OSV:GHSA-VQ6G-G6C7-5F2J...

richie (>=2.8.0, <=2.12.0), weblate (>=4.9.0, <=4.10.1) potentially affected by CVE-2026-57175 via social-auth-core (4.1.0)

social-auth-core PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - richie =2.8.0, =4.9.0, =4.10.1 Source cves: CVE-2026-57175 Source advisory: OSV:GHSA-VQ6G-G6C7-5F2J...

mycms (>=0.1.9, <=0.1.12) potentially affected by CVE-2026-57175 via social-auth-core (3.3.3)

social-auth-core PYPI version 3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - mycms =0.1.9, =0.1.12 Source cves: CVE-2026-57175 Source advisory: OSV:GHSA-VQ6G-G6C7-5F2J...

misago (>=0.39.0, <=0.39.6) potentially affected by CVE-2026-57175 via social-auth-core (4.5.1)

social-auth-core PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - misago =0.39.0, =0.39.6 Source cves: CVE-2026-57175 Source advisory: OSV:GHSA-VQ6G-G6C7-5F2J...

argus-notification-msteams (0.5.1), argus-server (>=1.2.1, <=1.22.1) +82 more potentially affected by CVE-2026-57175 via social-auth-core (4.9.1)

social-auth-core PYPI version 4.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - argus-notification-msteams 0.5.1 - argus-server =1.2.1, =1.30.0, =1.234.0, =0.4.3, =0.8.7, =0.0.2a17, =0.1.0, =1.0.0, =2.2.0a0,...

edx-auth-backends (>=1.0.1, <=2.0.2), pixelcms-server (>=0.4.1, <=0.4.2) +5 more potentially affected by CVE-2026-57175 via social-auth-core (1.7.0)

social-auth-core PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-auth-backends =1.0.1, =0.4.1, =1.2.0, =0.0.2, =0.2.0, =0.8.3, =1.0.0rc8 Source cves: CVE-2026-57175 Source advisory:...

rest-social-auth (>=1.0.0, <=1.1.0) potentially affected by CVE-2026-57175 via social-auth-core (0.2.1)

social-auth-core PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - rest-social-auth =1.0.0, =1.1.0 Source cves: CVE-2026-57175 Source advisory: OSV:GHSA-VQ6G-G6C7-5F2J...

umap-project (>=1.0.0rc9, <=1.0.0) potentially affected by CVE-2026-57175 via social-auth-core (3.0.0)

social-auth-core PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =1.0.0rc9, =1.0.0 Source cves: CVE-2026-57175 Source advisory: OSV:GHSA-VQ6G-G6C7-5F2J...

edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-57175 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-57175 Source advisory:...

umap-project (>=1.1.0, <=1.1.2) potentially affected by CVE-2026-57175 via social-auth-core (3.1.0)

social-auth-core PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =1.1.0, =1.1.2 Source cves: CVE-2026-57175 Source advisory: OSV:GHSA-VQ6G-G6C7-5F2J...