CVE-2026-57176
social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop. The issue affects applications using the Vend OAuth2 backend with more than one Vend shop. Version 5.0.0 patches the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop. The issue affects applications using the Vend OAuth2 backend with more than one Vend shop. Version 5.0.0 patches the issue.
- Record
CVE-2026-57176- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-289
- Updated
- 2026-11-02
EUVDEUVD-2026-86310
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop. The issue affects applications using the Vend OAuth2 backend with more than one Vend shop. Version 5.0.0 patches the issue.
- Record
EUVD-2026-86310- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fp7w-m676-w7gc
social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend
Impact
The Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID.
When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop.
The issue affects applications using the Vend OAuth2 backend with more than one Vend shop.
Patches
The issue has been fixed by scoping Vend social-auth UIDs by shop.
Users should upgrade to a patched version.
Fix:
Workarounds
Applications that cannot upgrade immediately should restrict the Vend OAuth2 backend to a single trusted Vend shop.
If Vend authentication is not required, the Vend backend can also be disabled by removing it from SOCIAL_AUTH_AUTHENTICATION_BACKENDS.
There is no complete workaround while continuing to allow authentication from multiple Vend shops with the vulnerable backend.
Credits
Reported through GitHub private vulnerability reporting by Liyi Zhou, Ziyue Wang, Strick, Maurice, and Chenchen Yu from the University of Sydney security research team.
Reporter references:
- Record
GHSA-fp7w-m676-w7gc- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-289
- Updated
- 2026-11-02
NVD
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop. The issue affects applications using the Vend OAuth2 backend with more than one Vend shop. Version 5.0.0 patches the issue.
- Record
CVE-2026-57176- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-289
- Updated
- 2026-11-02
OSV
social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop. The issue affects applications using the Vend OAuth2 backend with more than one Vend shop. Version 5.0.0 patches the issue.
- Record
CVE-2026-57176- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-289
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-57176
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop. The issue affects applications using the Vend OAuth2 backend with more than one Vend shop. Version 5.0.0 patches the issue.
- Record
DEBIAN-CVE-2026-57176- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-fp7w-m676-w7gc
social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend
Impact
The Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID.
When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop.
The issue affects applications using the Vend OAuth2 backend with more than one Vend shop.
Patches
The issue has been fixed by scoping Vend social-auth UIDs by shop.
Users should upgrade to a patched version.
Fix:
Workarounds
Applications that cannot upgrade immediately should restrict the Vend OAuth2 backend to a single trusted Vend shop.
If Vend authentication is not required, the Vend backend can also be disabled by removing it from SOCIAL_AUTH_AUTHENTICATION_BACKENDS.
There is no complete workaround while continuing to allow authentication from multiple Vend shops with the vulnerable backend.
Credits
Reported through GitHub private vulnerability reporting by Liyi Zhou, Ziyue Wang, Strick, Maurice, and Chenchen Yu from the University of Sydney security research team.
Reporter references:
- Record
GHSA-fp7w-m676-w7gc- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-289
- Updated
- 2026-11-02
OSVPYSEC-2026-4166
social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend
Impact
The Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID.
When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop.
The issue affects applications using the Vend OAuth2 backend with more than one Vend shop.
Patches
The issue has been fixed by scoping Vend social-auth UIDs by shop.
Users should upgrade to a patched version.
Fix:
Workarounds
Applications that cannot upgrade immediately should restrict the Vend OAuth2 backend to a single trusted Vend shop.
If Vend authentication is not required, the Vend backend can also be disabled by removing it from SOCIAL_AUTH_AUTHENTICATION_BACKENDS.
There is no complete workaround while continuing to allow authentication from multiple Vend shops with the vulnerable backend.
Credits
Reported through GitHub private vulnerability reporting by Liyi Zhou, Ziyue Wang, Strick, Maurice, and Chenchen Yu from the University of Sydney security research team.
Reporter references:
- Record
PYSEC-2026-4166- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-57176
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop. The issue affects applications using the Vend OAuth2 backend with more than one Vend shop. Version 5.0.0 patches the issue.
- Record
UBUNTU-CVE-2026-57176- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
social-auth-corePyPI |
before 5.0.0 | 5.0.0 |
social-auth-coreDebian:12 |
All versions, plus listed versions 4.3.0-14.4.2-14.4.2-24.5.3-14.5.4-1 Show 11 moreShow less4.5.6-14.6.1-14.8.1-14.8.3-14.8.5-14.8.7-14.9.1-15.0.2-15.1.0-15.1.0-25.1.1-1 |
None known |
social-auth-coreDebian:13 |
All versions, plus listed versions 4.6.1-14.8.1-14.8.3-14.8.5-14.8.7-1 Show 5 moreShow less4.9.1-15.0.2-15.1.0-15.1.0-25.1.1-1 |
None known |
social-auth-coreDebian:14 |
before 5.0.2-1, plus listed versions 4.6.1-14.8.1-14.8.3-14.8.5-14.8.7-14.9.1-1 |
5.0.2-1 |
social-auth-corePyPI |
before 5.0.0, plus listed versions 0.0.10.1.00.2.00.2.11.0.0 Show 45 moreShow less1.0.11.1.01.2.01.3.01.4.01.5.01.6.01.7.02.0.03.0.03.1.03.2.03.3.03.3.13.3.23.3.33.4.04.0.24.0.34.1.04.2.04.3.04.4.04.4.14.4.24.5.04.5.14.5.24.5.34.5.44.5.54.5.64.6.04.6.14.7.04.8.04.8.14.8.24.8.34.8.44.8.54.8.64.8.74.9.04.9.1 |
5.0.0 |
python2.7Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.7.5-8ubuntu32.7.5-8ubuntu42.7.6-22.7.6-2ubuntu12.7.6-3 Show 35 moreShow less2.7.6-3ubuntu12.7.6-42.7.6-4ubuntu12.7.6-52.7.6-72.7.6-82.7.6-8ubuntu0.22.7.6-8ubuntu0.32.7.6-8ubuntu0.42.7.6-8ubuntu0.52.7.6-8ubuntu0.6+esm22.7.6-8ubuntu0.6+esm32.7.6-8ubuntu0.6+esm52.7.6-8ubuntu0.6+esm62.7.6-8ubuntu0.6+esm72.7.6-8ubuntu0.6+esm82.7.6-8ubuntu0.6+esm92.7.6-8ubuntu0.6+esm102.7.6-8ubuntu0.6+esm112.7.6-8ubuntu0.6+esm122.7.6-8ubuntu0.6+esm132.7.6-8ubuntu0.6+esm142.7.6-8ubuntu0.6+esm152.7.6-8ubuntu0.6+esm162.7.6-8ubuntu0.6+esm172.7.6-8ubuntu0.6+esm182.7.6-8ubuntu0.6+esm202.7.6-8ubuntu0.6+esm212.7.6-8ubuntu0.6+esm222.7.6-8ubuntu0.6+esm242.7.6-8ubuntu0.6+esm252.7.6-8ubuntu0.6+esm262.7.6-8ubuntu0.6+esm282.7.6-8ubuntu0.6+esm292.7.6-8ubuntu0.6+esm30 |
None known |
python3.4Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.4~b1-0ubuntu33.4~b1-4ubuntu43.4~b1-4ubuntu63.4~b1-5ubuntu23.4~b2-1 Show 29 moreShow less3.4~b3-1ubuntu13.4~rc1-1build13.4~rc2-13.4~rc3-0ubuntu13.4.0-13.4.0-2ubuntu13.4.0-2ubuntu1.13.4.3-1ubuntu1~14.04.13.4.3-1ubuntu1~14.04.33.4.3-1ubuntu1~14.04.43.4.3-1ubuntu1~14.04.53.4.3-1ubuntu1~14.04.63.4.3-1ubuntu1~14.04.73.4.3-1ubuntu1~14.04.7+esm23.4.3-1ubuntu1~14.04.7+esm43.4.3-1ubuntu1~14.04.7+esm63.4.3-1ubuntu1~14.04.7+esm73.4.3-1ubuntu1~14.04.7+esm83.4.3-1ubuntu1~14.04.7+esm103.4.3-1ubuntu1~14.04.7+esm113.4.3-1ubuntu1~14.04.7+esm123.4.3-1ubuntu1~14.04.7+esm133.4.3-1ubuntu1~14.04.7+esm143.4.3-1ubuntu1~14.04.7+esm153.4.3-1ubuntu1~14.04.7+esm163.4.3-1ubuntu1~14.04.7+esm173.4.3-1ubuntu1~14.04.7+esm193.4.3-1ubuntu1~14.04.7+esm203.4.3-1ubuntu1~14.04.7+esm21 |
None known |
python3.5Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.5.2-2ubuntu0~16.04.4~14.04.13.5.2-2ubuntu0~16.04.4~14.04.1+esm13.5.2-2ubuntu0~16.04.4~14.04.1+esm33.5.2-2ubuntu0~16.04.4~14.04.1+esm43.5.2-2ubuntu0~16.04.4~14.04.1+esm5 Show 6 moreShow less3.5.2-2ubuntu0~16.04.4~14.04.1+esm63.5.2-2ubuntu0~16.04.4~14.04.1+esm73.5.2-2ubuntu0~16.04.4~14.04.1+esm83.5.2-2ubuntu0~16.04.4~14.04.1+esm93.5.2-2ubuntu0~16.04.4~14.04.1+esm103.5.2-2ubuntu0~16.04.4~14.04.1+esm11 |
None known |
python2.7Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.7.10-4ubuntu12.7.10-4ubuntu22.7.11-22.7.11-32.7.11-4 Show 37 moreShow less2.7.11-62.7.11-72.7.11-7ubuntu12.7.12-1~16.042.7.12-1ubuntu0~16.04.12.7.12-1ubuntu0~16.04.22.7.12-1ubuntu0~16.04.32.7.12-1ubuntu0~16.04.42.7.12-1ubuntu0~16.04.82.7.12-1ubuntu0~16.04.92.7.12-1ubuntu0~16.04.112.7.12-1ubuntu0~16.04.122.7.12-1ubuntu0~16.04.132.7.12-1ubuntu0~16.04.142.7.12-1ubuntu0~16.04.162.7.12-1ubuntu0~16.04.182.7.12-1ubuntu0~16.04.18+esm12.7.12-1ubuntu0~16.04.18+esm22.7.12-1ubuntu0~16.04.18+esm32.7.12-1ubuntu0~16.04.18+esm42.7.12-1ubuntu0~16.04.18+esm52.7.12-1ubuntu0~16.04.18+esm62.7.12-1ubuntu0~16.04.18+esm72.7.12-1ubuntu0~16.04.18+esm82.7.12-1ubuntu0~16.04.18+esm92.7.12-1ubuntu0~16.04.18+esm102.7.12-1ubuntu0~16.04.18+esm112.7.12-1ubuntu0~16.04.18+esm122.7.12-1ubuntu0~16.04.18+esm132.7.12-1ubuntu0~16.04.18+esm152.7.12-1ubuntu0~16.04.18+esm162.7.12-1ubuntu0~16.04.18+esm172.7.12-1ubuntu0~16.04.18+esm182.7.12-1ubuntu0~16.04.18+esm192.7.12-1ubuntu0~16.04.18+esm202.7.12-1ubuntu0~16.04.18+esm212.7.12-1ubuntu0~16.04.18+esm22 |
None known |
python3.5Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.5.0-33.5.0-3ubuntu13.5.1~rc1-2ubuntu13.5.1-13.5.1-2 Show 43 moreShow less3.5.1-33.5.1-53.5.1-6ubuntu13.5.1-6ubuntu23.5.1-9ubuntu13.5.1-103.5.2-2~16.013.5.2-2~16.043.5.2-2ubuntu0~16.04.13.5.2-2ubuntu0~16.04.23.5.2-2ubuntu0~16.04.33.5.2-2ubuntu0~16.04.43.5.2-2ubuntu0~16.04.53.5.2-2ubuntu0~16.04.83.5.2-2ubuntu0~16.04.93.5.2-2ubuntu0~16.04.103.5.2-2ubuntu0~16.04.113.5.2-2ubuntu0~16.04.123.5.2-2ubuntu0~16.04.133.5.2-2ubuntu0~16.04.13+esm13.5.2-2ubuntu0~16.04.13+esm23.5.2-2ubuntu0~16.04.13+esm33.5.2-2ubuntu0~16.04.13+esm53.5.2-2ubuntu0~16.04.13+esm63.5.2-2ubuntu0~16.04.13+esm73.5.2-2ubuntu0~16.04.13+esm83.5.2-2ubuntu0~16.04.13+esm93.5.2-2ubuntu0~16.04.13+esm103.5.2-2ubuntu0~16.04.13+esm113.5.2-2ubuntu0~16.04.13+esm123.5.2-2ubuntu0~16.04.13+esm133.5.2-2ubuntu0~16.04.13+esm143.5.2-2ubuntu0~16.04.13+esm153.5.2-2ubuntu0~16.04.13+esm163.5.2-2ubuntu0~16.04.13+esm173.5.2-2ubuntu0~16.04.13+esm183.5.2-2ubuntu0~16.04.13+esm193.5.2-2ubuntu0~16.04.13+esm203.5.2-2ubuntu0~16.04.13+esm213.5.2-2ubuntu0~16.04.13+esm223.5.2-2ubuntu0~16.04.13+esm233.5.2-2ubuntu0~16.04.13+esm243.5.2-2ubuntu0~16.04.13+esm25 |
None known |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python2.7Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.7.14-2ubuntu22.7.14-42.7.14-62.7.14-72.7.14-8 Show 31 moreShow less2.7.15~rc1-12.7.15~rc1-1ubuntu0.12.7.15-4ubuntu4~18.042.7.15-4ubuntu4~18.04.12.7.15-4ubuntu4~18.04.22.7.17-1~18.042.7.17-1~18.04ubuntu12.7.17-1~18.04ubuntu1.12.7.17-1~18.04ubuntu1.22.7.17-1~18.04ubuntu1.32.7.17-1~18.04ubuntu1.52.7.17-1~18.04ubuntu1.62.7.17-1~18.04ubuntu1.72.7.17-1~18.04ubuntu1.82.7.17-1~18.04ubuntu1.102.7.17-1~18.04ubuntu1.112.7.17-1~18.04ubuntu1.132.7.17-1~18.04ubuntu1.13+esm12.7.17-1~18.04ubuntu1.13+esm22.7.17-1~18.04ubuntu1.13+esm32.7.17-1~18.04ubuntu1.13+esm42.7.17-1~18.04ubuntu1.13+esm52.7.17-1~18.04ubuntu1.13+esm62.7.17-1~18.04ubuntu1.13+esm72.7.17-1~18.04ubuntu1.13+esm82.7.17-1~18.04ubuntu1.13+esm102.7.17-1~18.04ubuntu1.13+esm112.7.17-1~18.04ubuntu1.13+esm122.7.17-1~18.04ubuntu1.13+esm132.7.17-1~18.04ubuntu1.13+esm142.7.17-1~18.04ubuntu1.13+esm15 |
None known |
python3.6Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.6.3-1ubuntu13.6.4~rc1-13.6.4~rc1-23.6.4-13.6.4-2 Show 31 moreShow less3.6.4-3build13.6.4-43.6.5~rc1-13.6.5-33.6.6-1~18.043.6.7-1~18.043.6.8-1~18.04.13.6.8-1~18.04.23.6.8-1~18.04.33.6.9-1~18.043.6.9-1~18.04ubuntu13.6.9-1~18.04ubuntu1.13.6.9-1~18.04ubuntu1.33.6.9-1~18.04ubuntu1.43.6.9-1~18.04ubuntu1.63.6.9-1~18.04ubuntu1.73.6.9-1~18.04ubuntu1.83.6.9-1~18.04ubuntu1.93.6.9-1~18.04ubuntu1.103.6.9-1~18.04ubuntu1.123.6.9-1~18.04ubuntu1.133.6.9-1~18.04ubuntu1.13+esm13.6.9-1~18.04ubuntu1.13+esm23.6.9-1~18.04ubuntu1.13+esm33.6.9-1~18.04ubuntu1.13+esm43.6.9-1~18.04ubuntu1.13+esm53.6.9-1~18.04ubuntu1.13+esm63.6.9-1~18.04ubuntu1.13+esm73.6.9-1~18.04ubuntu1.13+esm83.6.9-1~18.04ubuntu1.13+esm93.6.9-1~18.04ubuntu1.13+esm10 |
None known |
python3.7Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.7.0~a2-13.7.0~a3-13.7.0~a3-23.7.0~a3-33.7.0~a4-1 Show 21 moreShow less3.7.0~b1-13.7.0~b1-1build13.7.0~b2-13.7.0~b3-13.7.0-1~18.043.7.1-1~18.043.7.3-2~18.04.13.7.5-2~18.043.7.5-2~18.04.43.7.5-2ubuntu1~18.04.23.7.5-2ubuntu1~18.04.2+esm13.7.5-2ubuntu1~18.04.2+esm23.7.5-2ubuntu1~18.04.2+esm33.7.5-2ubuntu1~18.04.2+esm43.7.5-2ubuntu1~18.04.2+esm53.7.5-2ubuntu1~18.04.2+esm63.7.5-2ubuntu1~18.04.2+esm73.7.5-2ubuntu1~18.04.2+esm83.7.5-2ubuntu1~18.04.2+esm93.7.5-2ubuntu1~18.04.2+esm103.7.5-2ubuntu1~18.04.2+esm11 |
None known |
python3.8Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.8.0-3~18.043.8.0-3~18.04.13.8.0-3ubuntu1~18.04.23.8.0-3ubuntu1~18.04.2+esm13.8.0-3ubuntu1~18.04.2+esm2 Show 9 moreShow less3.8.0-3ubuntu1~18.04.2+esm33.8.0-3ubuntu1~18.04.2+esm43.8.0-3ubuntu1~18.04.2+esm53.8.0-3ubuntu1~18.04.2+esm63.8.0-3ubuntu1~18.04.2+esm73.8.0-3ubuntu1~18.04.2+esm83.8.0-3ubuntu1~18.04.2+esm93.8.0-3ubuntu1~18.04.2+esm103.8.0-3ubuntu1~18.04.2+esm11 |
None known |
python3.8Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.8.0-13.8.0-23.8.0-33.8.0-43.8.0-5 Show 34 moreShow less3.8.1-2ubuntu33.8.2~rc1-1ubuntu13.8.2-13.8.2-1ubuntu13.8.2-1ubuntu1.13.8.2-1ubuntu1.23.8.5-1~20.043.8.5-1~20.04.23.8.5-1~20.04.33.8.10-0ubuntu1~20.043.8.10-0ubuntu1~20.04.13.8.10-0ubuntu1~20.04.23.8.10-0ubuntu1~20.04.43.8.10-0ubuntu1~20.04.53.8.10-0ubuntu1~20.04.63.8.10-0ubuntu1~20.04.73.8.10-0ubuntu1~20.04.83.8.10-0ubuntu1~20.04.93.8.10-0ubuntu1~20.04.103.8.10-0ubuntu1~20.04.113.8.10-0ubuntu1~20.04.123.8.10-0ubuntu1~20.04.133.8.10-0ubuntu1~20.04.143.8.10-0ubuntu1~20.04.153.8.10-0ubuntu1~20.04.163.8.10-0ubuntu1~20.04.173.8.10-0ubuntu1~20.04.183.8.10-0ubuntu1~20.04.18+esm13.8.10-0ubuntu1~20.04.18+esm23.8.10-0ubuntu1~20.04.18+esm33.8.10-0ubuntu1~20.04.18+esm43.8.10-0ubuntu1~20.04.18+esm53.8.10-0ubuntu1~20.04.18+esm63.8.10-0ubuntu1~20.04.18+esm7 |
None known |
python2.7Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.7.17~rc1-12.7.17-12.7.17-1ubuntu52.7.17-1ubuntu62.7.18~rc1-2 Show 22 moreShow less2.7.18-1~20.042.7.18-1~20.04.12.7.18-1~20.04.1+esm12.7.18-1~20.04.32.7.18-1~20.04.3+esm12.7.18-1~20.04.42.7.18-1~20.04.4+esm12.7.18-1~20.04.4+esm22.7.18-1~20.04.4+esm32.7.18-1~20.04.52.7.18-1~20.04.5+esm12.7.18-1~20.04.5+esm22.7.18-1~20.04.62.7.18-1~20.04.6+esm12.7.18-1~20.04.72.7.18-1~20.04.7+esm32.7.18-1~20.04.7+esm42.7.18-1~20.04.7+esm62.7.18-1~20.04.7+esm72.7.18-1~20.04.7+esm82.7.18-1~20.04.7+esm92.7.18-1~20.04.7+esm10 |
None known |
python3.9Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.9.0~rc1-1~20.043.9.0-5~20.043.9.5-3~20.04.13.9.5-3ubuntu0~20.04.13.9.5-3ubuntu0~20.04.1+esm1 Show 10 moreShow less3.9.5-3ubuntu0~20.04.1+esm23.9.5-3ubuntu0~20.04.1+esm33.9.5-3ubuntu0~20.04.1+esm43.9.5-3ubuntu0~20.04.1+esm53.9.5-3ubuntu0~20.04.1+esm63.9.5-3ubuntu0~20.04.1+esm73.9.5-3ubuntu0~20.04.1+esm83.9.5-3ubuntu0~20.04.1+esm93.9.5-3ubuntu0~20.04.1+esm103.9.5-3ubuntu0~20.04.1+esm11 |
None known |
python3.10Ubuntu:22.04:LTS |
All versions, plus listed versions 3.10.0-23.10.0-33.10.0-43.10.0-53.10.0-5build1 Show 30 moreShow less3.10.1-13.10.1-23.10.2-13.10.2-53.10.2-73.10.3-13.10.4-33.10.4-3ubuntu0.13.10.6-1~22.043.10.6-1~22.04.13.10.6-1~22.04.23.10.6-1~22.04.2ubuntu13.10.6-1~22.04.2ubuntu1.13.10.12-1~22.04.23.10.12-1~22.04.33.10.12-1~22.04.43.10.12-1~22.04.53.10.12-1~22.04.63.10.12-1~22.04.73.10.12-1~22.04.83.10.12-1~22.04.93.10.12-1~22.04.103.10.12-1~22.04.113.10.12-1~22.04.123.10.12-1~22.04.133.10.12-1~22.04.143.10.12-1~22.04.153.10.12-1~22.04.163.10.12-1~22.04.173.10.12-1~22.04.18 |
None known |
python2.7Ubuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.7.18-8build12.7.18-132.7.18-13ubuntu12.7.18-13ubuntu1.12.7.18-13ubuntu1.1+esm2 Show 16 moreShow less2.7.18-13ubuntu1.22.7.18-13ubuntu1.2+esm12.7.18-13ubuntu1.2+esm22.7.18-13ubuntu1.2+esm32.7.18-13ubuntu1.32.7.18-13ubuntu1.3+esm12.7.18-13ubuntu1.42.7.18-13ubuntu1.4+esm12.7.18-13ubuntu1.52.7.18-13ubuntu1.5+esm22.7.18-13ubuntu1.5+esm32.7.18-13ubuntu1.5+esm52.7.18-13ubuntu1.5+esm62.7.18-13ubuntu1.5+esm72.7.18-13ubuntu1.5+esm82.7.18-13ubuntu1.5+esm9 |
None known |
python3.11Ubuntu:Pro:22.04:LTS |
All versions, plus listed versions 3.11.0~rc1-1~22.043.11.0~rc1-1~22.04.1~esm13.11.0~rc1-1~22.04.1~esm23.11.0~rc1-1~22.04.1~esm33.11.0~rc1-1~22.04.1~esm4 Show 8 moreShow less3.11.0~rc1-1~22.04.1~esm53.11.0~rc1-1~22.04.1~esm63.11.0~rc1-1~22.04.1~esm73.11.0~rc1-1~22.04.1~esm83.11.0~rc1-1~22.04.1~esm93.11.0~rc1-1~22.04.13.11.0~rc1-1~22.04.1+esm13.11.0~rc1-1~22.04.1+esm2 |
None known |
python3.12Ubuntu:24.04:LTS |
All versions, plus listed versions 3.12.0-13.12.0-53.12.0-63.12.0-73.12.1-2 Show 21 moreShow less3.12.2-13.12.2-4build33.12.2-4build43.12.2-5ubuntu33.12.3-13.12.3-1ubuntu0.13.12.3-1ubuntu0.23.12.3-1ubuntu0.33.12.3-1ubuntu0.43.12.3-1ubuntu0.53.12.3-1ubuntu0.63.12.3-1ubuntu0.73.12.3-1ubuntu0.83.12.3-1ubuntu0.93.12.3-1ubuntu0.103.12.3-1ubuntu0.113.12.3-1ubuntu0.123.12.3-1ubuntu0.133.12.3-1ubuntu0.153.12.3-1ubuntu0.163.12.3-1ubuntu0.17 |
None known |
python3.14Ubuntu:26.10 |
All versions, plus listed versions 3.14.4-13.14.6-13.14.7-1ubuntu13.14.7-4ubuntu13.14.7-4ubuntu23.14.7-5ubuntu13.14.8-1ubuntu1 |
None known |
python3.14Ubuntu:26.04:LTS |
All versions, plus listed versions 3.14.0-13.14.0-23.14.0-43.14.2-13.14.3-1 Show 6 moreShow less3.14.3-23.14.3-33.14.3-53.14.4-13.14.4-1ubuntu0.13.14.4-1ubuntu0.2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-57176 is a medium vulnerability (CVSS 6.8) in Python-social-auth Social-core, published September 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in social-auth-core 5.0.0.
References
github.com/python-social-auth/social-core/security/advisories/GHSA-fp7w-m676-w7gc
nvd.nist.gov/vuln/detail/CVE-2026-57176