CVE-2026-57175 social-auth-core has an Improper Authentication issue

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could...

CVE-2026-57175

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could...

SUSE CVE-2026-66069

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, isauthorized/2 uses isauthorizedmonitor for all methods. DELETE resets rabbitcoremetrics:resetauthattemptmetrics. Impact is cosmetic counters only, no log erasure, but inconsistent with rabbitmgmtwmreset.erl...

Exploit for Code Injection in Apache Ofbiz

ofbiz-xmlrpc-rce CVE-2023-49070 PoC for the Apache OFBiz XM...

Improper Authorization

LogNet grpc-spring-boot-starter is vulnerable to improper authorization. The vulnerability is due to improper authorization in the Annotation Processing component, which allows an attacker to remotely bypass authorization controls and gain unauthorized access by exploiting the vulnerable...

Malicious Package

Overview bigops-auth-interceptor is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

CVE-2026-57179: Session Fixation

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted partialtoken as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could all...

CVE-2026-57175: Improper Authentication

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could...

PT-2026-98188

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.0.0 Description The Vend OAuth2 backend uses only the numeric user id as the social-auth UID. In applications where multiple Vend shops authenticate, users from different shops who share the same internal...

PT-2026-98191

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.0.0 Description The partial-pipeline resume mechanism accepts the partial token as a bearer credential without binding it to the browser session that created it. This allows an attacker to initiate an...

PT-2026-98190

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.0.0 Description The vk-app backend fails to verify the callback signature when the auth key parameter is omitted. This allows an attacker to provide unsigned, controlled data that the application treats a...

Linux Distros Unpatched Vulnerability : CVE-2026-66069

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, isauthorized/2 uses isauthorizedmonitor for all methods. DELETE resets...

CVE-2026-57176

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Ven...

PT-2026-98189

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.0.0 Description The LoginRadius backend fails to validate the OAuth state during the authentication flow. This leads to a login Cross-Site Request Forgery CSRF, where an attacker can force a victim's...

CVE-2026-57178: Improper Authentication

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

PT-2026-98187

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.0.0 Description The SAML backend accepts SAML responses on the Assertion Consumer Service endpoint without verifying that they match a previously issued AuthnRequest. This flaw allows an attacker with a...

CVE-2026-57176: Authentication Bypass by Alternate Name

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Ven...

CVE-2026-57179

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted partialtoken as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could all...

CVE-2026-57177

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to...

CVE-2026-57175

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could...