CVE-2026-57175: medium-severity vulnerability in python-social-auth social-core
social-auth-core has an Improper Authentication issue
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.4epss 0.2%
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued `AuthnRequest`. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML identity to a logged-in victim's local account. The attacker could then authenticate through SAML and gain access to the victim's account. The issue affects applications using the SAML backend together with authenticated account association. The issue has been fixed in version 5.0.0 by validating SAML responses against stored `AuthnRequest` IDs.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected products
python-social-auth · social-coreRelated CVEs — python-social-auth social-core
In the same product, most dangerous first.
CVE-2026-57176MEDIUMsocial-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend BackendEPSS 0.2%CVE-2026-57178HIGHsocial-auth-core: VK App backend accepts unsigned callback data when auth_key is missingEPSS 0.2%CVE-2026-57179MEDIUMsocial-auth-core has a Session Fixation issueEPSS 0.2%CVE-2026-115910MEDIUMPython Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victimEPSS 0.2%CVE-2026-62322MEDIUMPython Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)EPSS 0.2%CVE-2026-57177MEDIUMsocial-auth-core has Login CSRF via Missing State Parameter in LoginRadius BackendEPSS 0.1%