CVE-2026-57179 social-auth-core has a Session Fixation issue

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted partialtoken as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could all...

CVE-2026-57179

The Python Social Auth library (social-auth-core) is vulnerable to a Session Fixation issue in versions prior to 5.0.0 . The root cause is that the partial-pipeline resume mechanism accepts a partial_token as a bearer credential without binding it to the original browser session. This allows an a...

CVE-2026-57178

The Python Social Auth library, specifically the vk-app backend , is vulnerable to an authentication bypass in versions prior to 5.0.0 . The root cause is that the backend accepts VK application callback data without verifying the signature when the auth_key parameter is missing. This allows an a...

CVE-2026-57177

The python-social-auth (social-auth-core) library is vulnerable to Login CSRF in versions prior to 5.0.0 due to a missing state parameter validation in the LoginRadius backend . An attacker can trick a victim's browser into completing an authentication flow using an attacker-controlled token, res...

CVE-2026-57175

The Python Social Auth SAML backend is vulnerable to an improper authentication issue prior to version 5.0.0 . The root cause is the failure to verify that SAML responses on the Assertion Consumer Service endpoint match a previously issued AuthnRequest. An attacker with a valid account on a trust...

python311-social-auth-core-4.8.7-1.1 on GA media (moderate)

python311-social-auth-core-4.8.7-1.1 on GA media Announcement ID: openSUSE-SU-2026:10681-1 Rating: moderate Cross-References: CVE-2026-32597 CVSS scores: CVE-2026-32597 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2026-32597 SUSE : 8.7...