aa-rag (>=0.4.2, <=0.4.3), ab-auth-client-service (>=0.1.3, <=0.3.5) +1607 more potentially affected by CVE-2025-62727 via starlette (>=0.39.2, <=0.48.0)

starlette PYPI version =0.39.2, =0.4.2, =0.1.3, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.1, =0.1.0, =0.1.1, =0.1.1, =0.1.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.3 and more Source cves: CVE-2025-62727 Source advisory: OSV:PYSEC-2026-1942...

Python Social Auth - Django has unsafe account association

ImpactUpon authentication, the user could be associated by e-mail even if the associatebyemail pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses. Patches...

django-globus-portal-framework (>=0.3.23, <=0.4.2), django-user-app (0.0.6) +14 more potentially affected by CVE-2025-61783 via social-auth-app-django (4.0.0)

social-auth-app-django PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - django-globus-portal-framework =0.3.23, =2.28.1, =1.3.0, =1.0.0b3, =1.6.0, =0.9.2.dev0, =0.9.0, =0.1.0, =6.0.0,...

django-auth0-user (>=0.15.0, <=0.16.5), edx-auth-backends (>=3.0.0, <=3.0.2) +4 more potentially affected by CVE-2025-61783 via social-auth-app-django (3.4.0)

social-auth-app-django PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - django-auth0-user =0.15.0, =3.0.0, =0.1.0, =4.4.0a1, =0.2.0, =2.0.0, =5.0.1 Source cves: CVE-2025-61783 Source...

argus-notification-msteams (0.5.1), argus-server (>=1.0.0, <=1.22.1) +97 more potentially affected by CVE-2025-61783 via social-auth-app-django (>=5.0.0, <=5.4.3)

social-auth-app-django PYPI version =5.0.0, =1.0.0, =1.0.0, =4.14.0, =0.4.3, =0.8.7, =0.0.2a17, =1.0.0, =1.0.0, =2026.6.0, =1.2.0, =4.8.0, =0.0.2, =0.0.16 and more Source cves: CVE-2025-61783 Source advisory: OSV:PYSEC-2026-1932...

umap-project (>=0.8.0, <=0.8.2) potentially affected by CVE-2025-61783 via social-auth-app-django (1.0.1)

social-auth-app-django PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - umap-project =0.8.0, =0.8.2 Source cves: CVE-2025-61783 Source advisory: OSV:PYSEC-2026-1932...

umap-project (0.8.3) potentially affected by CVE-2025-61783 via social-auth-app-django (1.1.0)

social-auth-app-django PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - umap-project 0.8.3 Source cves: CVE-2025-61783 Source advisory: OSV:PYSEC-2026-1932...

cnili-authentication (0.0.1), django-rest-social-email-allauth (0.1.0) +5 more potentially affected by CVE-2025-61783 via social-auth-app-django (3.1.0)

social-auth-app-django PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - cnili-authentication 0.0.1 - django-rest-social-email-allauth 0.1.0 - libraryapp =3.0.8, =2.0.0b9, =0.9.6, =1.0.0rc9...

rest-social-auth (>=1.3.0, <=1.4.0), saltdash (>=0.9.1, <=0.9.5) +1 more potentially affected by CVE-2025-61783 via social-auth-app-django (2.1.0)

social-auth-app-django PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - rest-social-auth =1.3.0, =0.9.1, =1.0.0rc1, =1.0.0rc8 Source cves: CVE-2025-61783 Source advisory: OSV:PYSEC-2026-19...

edx-auth-backends (>=1.0.1, <=2.0.2), rest-social-auth (1.2.0) potentially affected by CVE-2025-61783 via social-auth-app-django (1.2.0)

social-auth-app-django PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - edx-auth-backends =1.0.1, =2.0.2 - rest-social-auth 1.2.0 Source cves: CVE-2025-61783 Source advisory:...

pixelcms-server (>=0.4.1, <=0.4.2), rest-social-auth (>=1.0.0, <=1.1.0) potentially affected by CVE-2025-61783 via social-auth-app-django (0.1.0)

social-auth-app-django PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - pixelcms-server =0.4.1, =1.0.0, =1.1.0 Source cves: CVE-2025-61783 Source advisory: OSV:PYSEC-2026-1932...

PYSEC-2026-1932 Python Social Auth - Django has unsafe account association

Impact Upon authentication, the user could be associated by e-mail even if the associatebyemail pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses. Patche...

annotell-auth (>=1.2.0, <=1.6.1), apicrud (>=0.0.59, <=0.3.6) +36 more potentially affected by CVE-2025-62706 via authlib (0.15.6)

authlib PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - annotell-auth =1.2.0, =0.0.59, =0.5.0, =5.0.0b1, =0.1.0, =2.1.4, =0.1.1, =0.1.1, =0.1.0, =0.3.10, =0.1.0, =0.0.1, =0.7.2, =0.9.4 and more Source...

django-cyverse-auth (1.0.0), django-iplant-auth (>=0.0.2, <=0.1.21) potentially affected by CVE-2025-61912 via python-ldap (2.4.19)

python-ldap PYPI version 2.4.19 is affected by a known vulnerability. The following packages have a transitive dependency on python-ldap and may be impacted: - django-cyverse-auth 1.0.0 - django-iplant-auth =0.0.2, =0.1.21 Source cves: CVE-2025-61912 Source advisory: OSV:PYSEC-2026-1846...

django-cyverse-auth (1.0.0), django-iplant-auth (>=0.0.2, <=0.1.21) potentially affected by CVE-2025-61911 via python-ldap (2.4.19)

python-ldap PYPI version 2.4.19 is affected by a known vulnerability. The following packages have a transitive dependency on python-ldap and may be impacted: - django-cyverse-auth 1.0.0 - django-iplant-auth =0.0.2, =0.1.21 Source cves: CVE-2025-61911 Source advisory: OSV:PYSEC-2026-1847...

seed-auth-api (>=0.9.0, <=0.9.2), umap-project (>=0.8.0, <=0.8.3) potentially affected by CVE-2026-48588 via django (1.10.5)

django PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - seed-auth-api =0.9.0, =0.8.0, =0.8.3 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

seed-auth-api (>=0.9.0, <=0.9.2), umap-project (>=0.8.0, <=0.8.3) potentially affected by CVE-2026-53878 via django (1.10.5)

django PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - seed-auth-api =0.9.0, =0.8.0, =0.8.3 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

atila-vue (>=0.1.3, <=0.1.3.5), contrail (>=0.3.0, <=1.0.2) +11 more potentially affected by CVE-2026-53878 via django (3.0.0rc1)

django PYPI version 3.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - atila-vue =0.1.3, =0.3.0, =0.1.1, =0.0.1, =0.0.1, =0.2.7, =0.2.0, =2.0.0, =2.3.1, =2.3.9 Source cves: CVE-2026-53878 Source advisory:...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the registryFor process. An attacker can obtain authentication credentials and trusted CA configuration by registering a sibling-domain registry that matches the unanchored suffix. Remediation...

Spotipy's cache file, containing spotify auth token, is created with overly broad permissions

SummaryThe CacheHandler class creates a cache file to store the auth token here: https://github.com/spotipy-dev/spotipy/blob/master/spotipy/cachehandler.pyL93-L98The file created has rw-r--r-- 644 permissions by default, when it could be locked down to rw------- 600 permissions. I think 600 is a...