CVE-2026-57177: fallo de gravedad media en python-social-auth social-core
social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.3epss 0.1%
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victim authenticated as the attacker's LoginRadius identity. The issue affects only applications using the LoginRadius backend. The issue has been fixe in version 5.0.0 by enabling callback state validation for the LoginRadius backend.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Productos afectados
python-social-auth · social-coreCVEs relacionadas — python-social-auth social-core
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-57175MEDIUMsocial-auth-core has an Improper Authentication issueEPSS 0.2%CVE-2026-57176MEDIUMsocial-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend BackendEPSS 0.2%CVE-2026-57178HIGHsocial-auth-core: VK App backend accepts unsigned callback data when auth_key is missingEPSS 0.2%CVE-2026-57179MEDIUMsocial-auth-core has a Session Fixation issueEPSS 0.2%CVE-2026-115910MEDIUMPython Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victimEPSS 0.2%CVE-2026-62322MEDIUMPython Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)EPSS 0.2%