social-auth-core has an Improper Authentication issue

ImpactThe SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest.Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML...

social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend

ImpactThe Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID.When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could...

galaxy (>=25.0.1, <=25.0.4) potentially affected by CVE-2026-57177 via social-auth-core (4.6.0)

social-auth-core PYPI version 4.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy =25.0.1, =25.0.4 Source cves: CVE-2026-57177 Source advisory: OSV:PYSEC-2026-4169...

misago (>=0.37.0, <=0.39.0b1) potentially affected by CVE-2026-57175 via social-auth-core (4.5.0)

social-auth-core PYPI version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - misago =0.37.0, =0.39.0b1 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...

umap-project (>=2.0.0a3, <=2.2.0b0) potentially affected by CVE-2026-57177 via social-auth-core (4.5.3)

social-auth-core PYPI version 4.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =2.0.0a3, =2.2.0b0 Source cves: CVE-2026-57177 Source advisory: OSV:PYSEC-2026-4169...

argilla-server (>=1.24.0rc3, <=2.8.0), extralit (0.1.0a5) +2 more potentially affected by CVE-2026-57177 via social-auth-core (4.5.6)

social-auth-core PYPI version 4.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - argilla-server =1.24.0rc3, =0.2.0, =3.0.0, =3.4.0 Source cves: CVE-2026-57177 Source advisory: OSV:PYSEC-2026-4169...

umap-project (>=1.3.0a0, <=1.14.0a5) potentially affected by CVE-2026-57175 via social-auth-core (4.4.2)

social-auth-core PYPI version 4.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =1.3.0a0, =1.14.0a5 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...

umap-project (>=3.4.1, <=3.5.0) potentially affected by CVE-2026-57175 via social-auth-core (4.8.1)

social-auth-core PYPI version 4.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =3.4.1, =3.5.0 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...

masonite-socialite (>=0.0.1, <=0.0.5), richie (>=2.0.0b9, <=2.7.1) potentially affected by CVE-2026-57175 via social-auth-core (3.2.0)

social-auth-core PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - masonite-socialite =0.0.1, =2.0.0b9, =2.7.1 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...

b9gemyaeix (>=4.14.0, <=4.14.1), edx-oauth2-wordpress-backend (>=1.0.7, <=1.0.8) +15 more potentially affected by CVE-2026-57177 via social-auth-core (4.3.0)

social-auth-core PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - b9gemyaeix =4.14.0, =1.0.7, =1.0.0, =1.0.0, =1.0.0rc1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =3.5.0rc4, =4.0.0rc6,...

netbox-types (>=4.5.4, <=4.6.5), umap-project (>=3.6.2, <=3.7.3) potentially affected by CVE-2026-57177 via social-auth-core (4.8.5)

social-auth-core PYPI version 4.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - netbox-types =4.5.4, =3.6.2, =3.7.3 Source cves: CVE-2026-57177 Source advisory: OSV:PYSEC-2026-4169...

social-auth-liu (0.0.1) potentially affected by CVE-2026-57177 via social-auth-core (1.2.0)

social-auth-core PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - social-auth-liu 0.0.1 Source cves: CVE-2026-57177 Source advisory: OSV:PYSEC-2026-4169...

django-auth0-user (>=0.15.0, <=0.16.5), django-rest-social-email-allauth (0.1.0) +6 more potentially affected by CVE-2026-57175 via social-auth-core (3.4.0)

social-auth-core PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - django-auth0-user =0.15.0, =3.0.0, =4.4.0a1, =0.2.0, =2.0.0, =0.0.5, =1.0.2 - social-auth-mitxpro 0.1.0 Source cves:...

social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

ImpactThe LoginRadius backend did not validate OAuth state during the authentication flow.Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victim...

umap-project (>=0.8.0, <=0.8.2) potentially affected by CVE-2026-57175 via social-auth-core (1.1.0)

social-auth-core PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =0.8.0, =0.8.2 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...

umap-project (>=2.0.0a3, <=2.2.0b0) potentially affected by CVE-2026-57175 via social-auth-core (4.5.3)

social-auth-core PYPI version 4.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =2.0.0a3, =2.2.0b0 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...

umap-project (>=2.0.0a0, <=2.0.0a2) potentially affected by CVE-2026-57175 via social-auth-core (4.5.2)

social-auth-core PYPI version 4.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =2.0.0a0, =2.0.0a2 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...

PYSEC-2026-4165 social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Impact The vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such a...

PYSEC-2026-4166 social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend

Impact The Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop coul...

PYSEC-2026-4168 social-auth-core has a Session Fixation issue

Impact The partial-pipeline resume mechanism accepted partialtoken as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow, obtain a valid partial token and...