CVE-2026-126775

The Social-auth-core library (versions 4.7.0 before 7.0.0) contains a login cross-site request forgery (CSRF) vulnerability in its SAML backend . The root cause is that the backend restores sessions specified in the unsigned RelayState parameter . An attacker can exploit this by delivering a vali...