GHSA-FP7W-M676-W7GC social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend

Impact The Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop coul...