Authentication Bypass by Alternate Name

Overview social-auth-core is a package that makes Python social authentication simple. Affected versions of this package are vulnerable to Authentication Bypass by Alternate Name via the getuserid method in the Vend OAuth2 backend socialcore/backends/vend.py, where user identifiers are scoped onl...

CVE-2026-56300

Capgo before 12.128.2 contains unauthenticated security definer RPC functions getuserid and getorgpermforapikey that expose API key validity oracles and user UUID disclosure. Unauthenticated attackers using the public API key can validate leaked keys, enumerate users and apps, and determine...

CVE-2026-56300: Exposure of Sensitive Information to an Unauthorized Actor

Capgo before 12.128.2 contains unauthenticated security definer RPC functions getuserid and getorgpermforapikey that expose API key validity oracles and user UUID disclosure. Unauthenticated attackers using the public API key can validate leaked keys, enumerate users and apps, and determine...