[ Vendor · 6 CVEs ]
python-social-auth
CVEs affecting python-social-auth published in the last 30 days, plus any python-social-auth CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-62322 | 15 Oct 2026 | CVSS 6.5 | Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without… | Fix |
| CVE-2026-57179 | 24 Sep 2026 | CVSS 4.2 | social-auth-core has a Session Fixation issuePython Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted… | Fix |
| CVE-2026-57175 | 24 Sep 2026 | CVSS 6.4 | social-auth-core has an Improper Authentication issuePython Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the… | Fix |
| CVE-2026-57176 | 24 Sep 2026 | CVSS 6.8 | social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend BackendPython Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend… | Fix |
| CVE-2026-57177 | 24 Sep 2026 | CVSS 4.3 | social-auth-core has Login CSRF via Missing State Parameter in LoginRadius BackendPython Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state… | Fix |
| CVE-2026-57178 | 24 Sep 2026 | CVSS 7.4 | social-auth-core: VK App backend accepts unsigned callback data when auth_key is missingPython Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the `vk-app` backend accepted VK application callback… | Fix |