CVE-2026-62322mediumCWE-352

CVE-2026-62322: medium-severity vulnerability in python-social-auth social-core

Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

Published · Updated

Follow this CVE+ Monitor social-core+ Monitor social-auth-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.2%
Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resulting callback URL, causing the application to log the victim into the attacker's account. When account linking is enabled, the same missing validation can link the attacker's LINE identity to the victim's existing account and create a persistent unauthorized login path. Only applications with the LINE backend enabled are affected. This issue is fixed in version 5.0.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected products
python-social-auth · social-core
Related CVEs — python-social-auth social-core

In the same product, most dangerous first.

CVE-2026-57175MEDIUMsocial-auth-core has an Improper Authentication issueEPSS 0.2%CVE-2026-57176MEDIUMsocial-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend BackendEPSS 0.2%CVE-2026-57178HIGHsocial-auth-core: VK App backend accepts unsigned callback data when auth_key is missingEPSS 0.2%CVE-2026-57179MEDIUMsocial-auth-core has a Session Fixation issueEPSS 0.2%CVE-2026-115910MEDIUMPython Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victimEPSS 0.2%CVE-2026-57177MEDIUMsocial-auth-core has Login CSRF via Missing State Parameter in LoginRadius BackendEPSS 0.1%