Python Social Auth: OpenID Connect Nonce Is Not Bound To The Browser Session, So A Stolen Authorization Code Logs The At

Summary The generic OpenID Connect backend "OpenIdConnectAuth" and every backend built on it stores the "nonce" in the shared Association table, not in the user's session. When the ID token comes back, "validateclaims" only checks that the nonce exists in that table and is not expired. It does no...

galaxy-app (>=23.0.1, <=24.0.3), galaxy-data (>=22.1.1, <=24.1.3) +13 more potentially affected by CVE-2026-115910 via social-auth-core (4.0.3)

social-auth-core PYPI version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy-app =23.0.1, =22.1.1, =23.0.1, =23.0.2, =21.9.0, =23.2.1, =0.4.0, =0.0.1, =0.13.0, =0.6.0, =0.1.0, =0.8.0, =0.1.0, =0.9.1...

umap-project (>=0.8.0, <=0.8.2) potentially affected by CVE-2026-115910 via social-auth-core (1.1.0)

social-auth-core PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =0.8.0, =0.8.2 Source cves: CVE-2026-115910 Source advisory: OSV:GHSA-H2R5-X5M7-3935...

social-auth-liu (0.0.1) potentially affected by CVE-2026-115910 via social-auth-core (1.2.0)

social-auth-core PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - social-auth-liu 0.0.1 Source cves: CVE-2026-115910 Source advisory: OSV:GHSA-H2R5-X5M7-3935...

masonite-socialite (>=0.0.1, <=0.0.5), richie (>=2.0.0b9, <=2.7.1) potentially affected by CVE-2026-115910 via social-auth-core (3.2.0)

social-auth-core PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - masonite-socialite =0.0.1, =2.0.0b9, =2.7.1 Source cves: CVE-2026-115910 Source advisory: OSV:GHSA-H2R5-X5M7-3935...

linhub (0.1.1) potentially affected by CVE-2026-115910 via social-auth-core (4.4.1)

social-auth-core PYPI version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - linhub 0.1.1 Source cves: CVE-2026-115910 Source advisory: OSV:GHSA-H2R5-X5M7-3935...

umap-project (>=1.3.0a0, <=1.14.0a5) potentially affected by CVE-2026-115910 via social-auth-core (4.4.2)

social-auth-core PYPI version 4.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =1.3.0a0, =1.14.0a5 Source cves: CVE-2026-115910 Source advisory: OSV:GHSA-H2R5-X5M7-3935...

misago (>=0.37.0, <=0.39.0b1) potentially affected by CVE-2026-115910 via social-auth-core (4.5.0)

social-auth-core PYPI version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - misago =0.37.0, =0.39.0b1 Source cves: CVE-2026-115910 Source advisory: OSV:GHSA-H2R5-X5M7-3935...

argus-server (>=1.23.0, <=1.34.1), bitcaster (>=2.1.0rc1, <=2.2.0) +14 more potentially affected by CVE-2026-115910 via social-auth-core (4.8.7)

social-auth-core PYPI version 4.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - argus-server =1.23.0, =2.1.0rc1, =2.4.6, =2.0.9, =1.0.1, =0.16.0, =2024.1.0, =1.62.0, =5.7.0, =0.10.0, =5.6.0, =0.1.0, =0.12.0 a...

netbox (4.7.2) potentially affected by CVE-2026-115910 via social-auth-core (5.1.1)

social-auth-core PYPI version 5.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - netbox 4.7.2 Source cves: CVE-2026-115910 Source advisory: OSV:GHSA-H2R5-X5M7-3935...

django-bom (>=1.310.0, <=1.317.0), galaxy-app (>=20.5.0, <=26.1.2) +84 more potentially affected by CVE-2026-115910 via social-auth-core (5.2.0)

social-auth-core PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - django-bom =1.310.0, =20.5.0, =20.5.0, =26.0.2, =19.9.0.dev0, =20.5.0, =20.5.0, =26.0.1, =23.2.1, =20.5.0, =20.5.0, =24.1.1,...

umap-project (3.1.0) potentially affected by CVE-2026-115910 via social-auth-core (4.6.1)

social-auth-core PYPI version 4.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project 3.1.0 Source cves: CVE-2026-115910 Source advisory: OSV:GHSA-H2R5-X5M7-3935...

argilla-server (>=1.24.0rc3, <=2.8.0), extralit (0.1.0a5) +2 more potentially affected by CVE-2026-115910 via social-auth-core (4.5.6)

social-auth-core PYPI version 4.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - argilla-server =1.24.0rc3, =0.2.0, =3.0.0, =3.4.0 Source cves: CVE-2026-115910 Source advisory: OSV:GHSA-H2R5-X5M7-3935...

GHSA-H2R5-X5M7-3935 Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim

Summary The generic OpenID Connect backend OpenIdConnectAuth and every backend built on it stores the nonce in the shared Association table, not in the user's session. When the ID token comes back, validateclaims only checks that the nonce exists in that table and is not expired. It does not chec...

b9gemyaeix (>=4.14.0, <=4.14.1), edx-oauth2-wordpress-backend (>=1.0.7, <=1.0.8) +15 more potentially affected by CVE-2026-115910 via social-auth-core (4.3.0)

social-auth-core PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - b9gemyaeix =4.14.0, =1.0.7, =1.0.0, =1.0.0, =1.0.0rc1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =3.5.0rc4, =4.0.0rc6,...

gophers (>=0.0.1, <=0.0.2), gupy-framework (>=0.0.1, <=0.5.8) +2 more potentially affected by CVE-2026-115910 via social-auth-core (4.5.4)

social-auth-core PYPI version 4.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - gophers =0.0.1, =0.0.1, =0.1.1, =2.2.0, =2.9.3 Source cves: CVE-2026-115910 Source advisory: OSV:GHSA-H2R5-X5M7-3935...

umap-project (>=1.0.0rc9, <=1.0.0) potentially affected by CVE-2026-115910 via social-auth-core (3.0.0)

social-auth-core PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =1.0.0rc9, =1.0.0 Source cves: CVE-2026-115910 Source advisory: OSV:GHSA-H2R5-X5M7-3935...

umap-project (>=1.2.2, <=1.2.3) potentially affected by CVE-2026-115910 via social-auth-core (3.3.2)

social-auth-core PYPI version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =1.2.2, =1.2.3 Source cves: CVE-2026-115910 Source advisory: OSV:GHSA-H2R5-X5M7-3935...

mycms (>=0.1.9, <=0.1.12) potentially affected by CVE-2026-115910 via social-auth-core (3.3.3)

social-auth-core PYPI version 3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - mycms =0.1.9, =0.1.12 Source cves: CVE-2026-115910 Source advisory: OSV:GHSA-H2R5-X5M7-3935...

umap-project (>=2.0.0a0, <=2.0.0a2) potentially affected by CVE-2026-115910 via social-auth-core (4.5.2)

social-auth-core PYPI version 4.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =2.0.0a0, =2.0.0a2 Source cves: CVE-2026-115910 Source advisory: OSV:GHSA-H2R5-X5M7-3935...