CVE-2026-57178 social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...