CVE-2025-61783mediumCWE-303

CVE-2025-61783: medium-severity vulnerability in python-social-auth social-app-django

Python Social Auth - Django has unsafe account association

Published · Updated

Follow this CVE+ Monitor social-app-django+ Monitor social-auth-app-django

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 0.5%
Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses. Version 5.6.0 contains a patch. As a workaround, review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
python-social-auth · social-app-django
Related CVEs — python-social-auth social-app-django

In the same product, most dangerous first.

CVE-2024-32879MEDIUMsocial-auth-app-django Improper Handling of Case Sensitivity vulnerabilityEPSS 0.6%