CVE-2026-57178
social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the auth_key parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as viewer_id, access_token, api_id, and api_result, potentially allowing authentication as an arbitrary VK user ID. The issue affects only applications using the vk-app backend. The issue has been fixed in version 5.0.0 by requiring auth_key to be present and valid before callback data is trusted.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the auth_key parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as viewer_id, access_token, api_id, and api_result, potentially allowing authentication as an arbitrary VK user ID. The issue affects only applications using the vk-app backend. The issue has been fixed in version 5.0.0 by requiring auth_key to be present and valid before callback data is trusted.
- Record
CVE-2026-57178- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-287, CWE-347
- Updated
- 2026-11-02
EUVDEUVD-2026-86312
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the auth_key parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as viewer_id, access_token, api_id, and api_result, potentially allowing authentication as an arbitrary VK user ID. The issue affects only applications using the vk-app backend. The issue has been fixed in version 5.0.0 by requiring auth_key to be present and valid before callback data is trusted.
- Record
EUVD-2026-86312- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3c93-f73f-qc9h
social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing
Impact
The vk-app backend accepted VK application callback data without verifying the callback signature when the auth_key parameter was omitted.
Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as viewer_id, access_token, api_id, and api_result, potentially allowing authentication as an arbitrary VK user ID.
The issue affects only applications using the vk-app backend.
Patches
The issue has been fixed by requiring auth_key to be present and valid before callback data is trusted.
Users should upgrade to a patched version.
Fix:
Workarounds
Applications that cannot upgrade immediately should disable the vk-app backend by removing social_core.backends.vk.VKAppOAuth2 from SOCIAL_AUTH_AUTHENTICATION_BACKENDS.
There is no complete workaround while continuing to use the vulnerable backend.
Credits
Reported by @lalalala5678 through GitHub private vulnerability reporting.
- Record
GHSA-3c93-f73f-qc9h- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-287, CWE-347
- Updated
- 2026-11-02
NVD
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the auth_key parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as viewer_id, access_token, api_id, and api_result, potentially allowing authentication as an arbitrary VK user ID. The issue affects only applications using the vk-app backend. The issue has been fixed in version 5.0.0 by requiring auth_key to be present and valid before callback data is trusted.
- Record
CVE-2026-57178- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-287, CWE-347
- Updated
- 2026-11-02
OSV
social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the auth_key parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as viewer_id, access_token, api_id, and api_result, potentially allowing authentication as an arbitrary VK user ID. The issue affects only applications using the vk-app backend. The issue has been fixed in version 5.0.0 by requiring auth_key to be present and valid before callback data is trusted.
- Record
CVE-2026-57178- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-287, CWE-347
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-57178
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the auth_key parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as viewer_id, access_token, api_id, and api_result, potentially allowing authentication as an arbitrary VK user ID. The issue affects only applications using the vk-app backend. The issue has been fixed in version 5.0.0 by requiring auth_key to be present and valid before callback data is trusted.
- Record
DEBIAN-CVE-2026-57178- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-3c93-f73f-qc9h
social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing
Impact
The vk-app backend accepted VK application callback data without verifying the callback signature when the auth_key parameter was omitted.
Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as viewer_id, access_token, api_id, and api_result, potentially allowing authentication as an arbitrary VK user ID.
The issue affects only applications using the vk-app backend.
Patches
The issue has been fixed by requiring auth_key to be present and valid before callback data is trusted.
Users should upgrade to a patched version.
Fix:
Workarounds
Applications that cannot upgrade immediately should disable the vk-app backend by removing social_core.backends.vk.VKAppOAuth2 from SOCIAL_AUTH_AUTHENTICATION_BACKENDS.
There is no complete workaround while continuing to use the vulnerable backend.
Credits
Reported by @lalalala5678 through GitHub private vulnerability reporting.
- Record
GHSA-3c93-f73f-qc9h- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-287, CWE-347
- Updated
- 2026-11-02
OSVPYSEC-2026-4165
social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing
Impact
The vk-app backend accepted VK application callback data without verifying the callback signature when the auth_key parameter was omitted.
Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as viewer_id, access_token, api_id, and api_result, potentially allowing authentication as an arbitrary VK user ID.
The issue affects only applications using the vk-app backend.
Patches
The issue has been fixed by requiring auth_key to be present and valid before callback data is trusted.
Users should upgrade to a patched version.
Fix:
Workarounds
Applications that cannot upgrade immediately should disable the vk-app backend by removing social_core.backends.vk.VKAppOAuth2 from SOCIAL_AUTH_AUTHENTICATION_BACKENDS.
There is no complete workaround while continuing to use the vulnerable backend.
Credits
Reported by @lalalala5678 through GitHub private vulnerability reporting.
- Record
PYSEC-2026-4165- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-57178
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the auth_key parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as viewer_id, access_token, api_id, and api_result, potentially allowing authentication as an arbitrary VK user ID. The issue affects only applications using the vk-app backend. The issue has been fixed in version 5.0.0 by requiring auth_key to be present and valid before callback data is trusted.
- Record
UBUNTU-CVE-2026-57178- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
social-auth-corePyPI |
before 5.0.0 | 5.0.0 |
social-auth-coreDebian:12 |
All versions, plus listed versions 4.3.0-14.4.2-14.4.2-24.5.3-14.5.4-1 Show 11 moreShow less4.5.6-14.6.1-14.8.1-14.8.3-14.8.5-14.8.7-14.9.1-15.0.2-15.1.0-15.1.0-25.1.1-1 |
None known |
social-auth-coreDebian:13 |
All versions, plus listed versions 4.6.1-14.8.1-14.8.3-14.8.5-14.8.7-1 Show 5 moreShow less4.9.1-15.0.2-15.1.0-15.1.0-25.1.1-1 |
None known |
social-auth-coreDebian:14 |
before 5.0.2-1, plus listed versions 4.6.1-14.8.1-14.8.3-14.8.5-14.8.7-14.9.1-1 |
5.0.2-1 |
social-auth-corePyPI |
before 5.0.0, plus listed versions 0.0.10.1.00.2.00.2.11.0.0 Show 45 moreShow less1.0.11.1.01.2.01.3.01.4.01.5.01.6.01.7.02.0.03.0.03.1.03.2.03.3.03.3.13.3.23.3.33.4.04.0.24.0.34.1.04.2.04.3.04.4.04.4.14.4.24.5.04.5.14.5.24.5.34.5.44.5.54.5.64.6.04.6.14.7.04.8.04.8.14.8.24.8.34.8.44.8.54.8.64.8.74.9.04.9.1 |
5.0.0 |
python2.7Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.7.5-8ubuntu32.7.5-8ubuntu42.7.6-22.7.6-2ubuntu12.7.6-3 Show 35 moreShow less2.7.6-3ubuntu12.7.6-42.7.6-4ubuntu12.7.6-52.7.6-72.7.6-82.7.6-8ubuntu0.22.7.6-8ubuntu0.32.7.6-8ubuntu0.42.7.6-8ubuntu0.52.7.6-8ubuntu0.6+esm22.7.6-8ubuntu0.6+esm32.7.6-8ubuntu0.6+esm52.7.6-8ubuntu0.6+esm62.7.6-8ubuntu0.6+esm72.7.6-8ubuntu0.6+esm82.7.6-8ubuntu0.6+esm92.7.6-8ubuntu0.6+esm102.7.6-8ubuntu0.6+esm112.7.6-8ubuntu0.6+esm122.7.6-8ubuntu0.6+esm132.7.6-8ubuntu0.6+esm142.7.6-8ubuntu0.6+esm152.7.6-8ubuntu0.6+esm162.7.6-8ubuntu0.6+esm172.7.6-8ubuntu0.6+esm182.7.6-8ubuntu0.6+esm202.7.6-8ubuntu0.6+esm212.7.6-8ubuntu0.6+esm222.7.6-8ubuntu0.6+esm242.7.6-8ubuntu0.6+esm252.7.6-8ubuntu0.6+esm262.7.6-8ubuntu0.6+esm282.7.6-8ubuntu0.6+esm292.7.6-8ubuntu0.6+esm30 |
None known |
python3.4Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.4~b1-0ubuntu33.4~b1-4ubuntu43.4~b1-4ubuntu63.4~b1-5ubuntu23.4~b2-1 Show 29 moreShow less3.4~b3-1ubuntu13.4~rc1-1build13.4~rc2-13.4~rc3-0ubuntu13.4.0-13.4.0-2ubuntu13.4.0-2ubuntu1.13.4.3-1ubuntu1~14.04.13.4.3-1ubuntu1~14.04.33.4.3-1ubuntu1~14.04.43.4.3-1ubuntu1~14.04.53.4.3-1ubuntu1~14.04.63.4.3-1ubuntu1~14.04.73.4.3-1ubuntu1~14.04.7+esm23.4.3-1ubuntu1~14.04.7+esm43.4.3-1ubuntu1~14.04.7+esm63.4.3-1ubuntu1~14.04.7+esm73.4.3-1ubuntu1~14.04.7+esm83.4.3-1ubuntu1~14.04.7+esm103.4.3-1ubuntu1~14.04.7+esm113.4.3-1ubuntu1~14.04.7+esm123.4.3-1ubuntu1~14.04.7+esm133.4.3-1ubuntu1~14.04.7+esm143.4.3-1ubuntu1~14.04.7+esm153.4.3-1ubuntu1~14.04.7+esm163.4.3-1ubuntu1~14.04.7+esm173.4.3-1ubuntu1~14.04.7+esm193.4.3-1ubuntu1~14.04.7+esm203.4.3-1ubuntu1~14.04.7+esm21 |
None known |
python3.5Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.5.2-2ubuntu0~16.04.4~14.04.13.5.2-2ubuntu0~16.04.4~14.04.1+esm13.5.2-2ubuntu0~16.04.4~14.04.1+esm33.5.2-2ubuntu0~16.04.4~14.04.1+esm43.5.2-2ubuntu0~16.04.4~14.04.1+esm5 Show 6 moreShow less3.5.2-2ubuntu0~16.04.4~14.04.1+esm63.5.2-2ubuntu0~16.04.4~14.04.1+esm73.5.2-2ubuntu0~16.04.4~14.04.1+esm83.5.2-2ubuntu0~16.04.4~14.04.1+esm93.5.2-2ubuntu0~16.04.4~14.04.1+esm103.5.2-2ubuntu0~16.04.4~14.04.1+esm11 |
None known |
python2.7Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.7.10-4ubuntu12.7.10-4ubuntu22.7.11-22.7.11-32.7.11-4 Show 37 moreShow less2.7.11-62.7.11-72.7.11-7ubuntu12.7.12-1~16.042.7.12-1ubuntu0~16.04.12.7.12-1ubuntu0~16.04.22.7.12-1ubuntu0~16.04.32.7.12-1ubuntu0~16.04.42.7.12-1ubuntu0~16.04.82.7.12-1ubuntu0~16.04.92.7.12-1ubuntu0~16.04.112.7.12-1ubuntu0~16.04.122.7.12-1ubuntu0~16.04.132.7.12-1ubuntu0~16.04.142.7.12-1ubuntu0~16.04.162.7.12-1ubuntu0~16.04.182.7.12-1ubuntu0~16.04.18+esm12.7.12-1ubuntu0~16.04.18+esm22.7.12-1ubuntu0~16.04.18+esm32.7.12-1ubuntu0~16.04.18+esm42.7.12-1ubuntu0~16.04.18+esm52.7.12-1ubuntu0~16.04.18+esm62.7.12-1ubuntu0~16.04.18+esm72.7.12-1ubuntu0~16.04.18+esm82.7.12-1ubuntu0~16.04.18+esm92.7.12-1ubuntu0~16.04.18+esm102.7.12-1ubuntu0~16.04.18+esm112.7.12-1ubuntu0~16.04.18+esm122.7.12-1ubuntu0~16.04.18+esm132.7.12-1ubuntu0~16.04.18+esm152.7.12-1ubuntu0~16.04.18+esm162.7.12-1ubuntu0~16.04.18+esm172.7.12-1ubuntu0~16.04.18+esm182.7.12-1ubuntu0~16.04.18+esm192.7.12-1ubuntu0~16.04.18+esm202.7.12-1ubuntu0~16.04.18+esm212.7.12-1ubuntu0~16.04.18+esm22 |
None known |
python3.5Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.5.0-33.5.0-3ubuntu13.5.1~rc1-2ubuntu13.5.1-13.5.1-2 Show 43 moreShow less3.5.1-33.5.1-53.5.1-6ubuntu13.5.1-6ubuntu23.5.1-9ubuntu13.5.1-103.5.2-2~16.013.5.2-2~16.043.5.2-2ubuntu0~16.04.13.5.2-2ubuntu0~16.04.23.5.2-2ubuntu0~16.04.33.5.2-2ubuntu0~16.04.43.5.2-2ubuntu0~16.04.53.5.2-2ubuntu0~16.04.83.5.2-2ubuntu0~16.04.93.5.2-2ubuntu0~16.04.103.5.2-2ubuntu0~16.04.113.5.2-2ubuntu0~16.04.123.5.2-2ubuntu0~16.04.133.5.2-2ubuntu0~16.04.13+esm13.5.2-2ubuntu0~16.04.13+esm23.5.2-2ubuntu0~16.04.13+esm33.5.2-2ubuntu0~16.04.13+esm53.5.2-2ubuntu0~16.04.13+esm63.5.2-2ubuntu0~16.04.13+esm73.5.2-2ubuntu0~16.04.13+esm83.5.2-2ubuntu0~16.04.13+esm93.5.2-2ubuntu0~16.04.13+esm103.5.2-2ubuntu0~16.04.13+esm113.5.2-2ubuntu0~16.04.13+esm123.5.2-2ubuntu0~16.04.13+esm133.5.2-2ubuntu0~16.04.13+esm143.5.2-2ubuntu0~16.04.13+esm153.5.2-2ubuntu0~16.04.13+esm163.5.2-2ubuntu0~16.04.13+esm173.5.2-2ubuntu0~16.04.13+esm183.5.2-2ubuntu0~16.04.13+esm193.5.2-2ubuntu0~16.04.13+esm203.5.2-2ubuntu0~16.04.13+esm213.5.2-2ubuntu0~16.04.13+esm223.5.2-2ubuntu0~16.04.13+esm233.5.2-2ubuntu0~16.04.13+esm243.5.2-2ubuntu0~16.04.13+esm25 |
None known |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python2.7Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.7.14-2ubuntu22.7.14-42.7.14-62.7.14-72.7.14-8 Show 31 moreShow less2.7.15~rc1-12.7.15~rc1-1ubuntu0.12.7.15-4ubuntu4~18.042.7.15-4ubuntu4~18.04.12.7.15-4ubuntu4~18.04.22.7.17-1~18.042.7.17-1~18.04ubuntu12.7.17-1~18.04ubuntu1.12.7.17-1~18.04ubuntu1.22.7.17-1~18.04ubuntu1.32.7.17-1~18.04ubuntu1.52.7.17-1~18.04ubuntu1.62.7.17-1~18.04ubuntu1.72.7.17-1~18.04ubuntu1.82.7.17-1~18.04ubuntu1.102.7.17-1~18.04ubuntu1.112.7.17-1~18.04ubuntu1.132.7.17-1~18.04ubuntu1.13+esm12.7.17-1~18.04ubuntu1.13+esm22.7.17-1~18.04ubuntu1.13+esm32.7.17-1~18.04ubuntu1.13+esm42.7.17-1~18.04ubuntu1.13+esm52.7.17-1~18.04ubuntu1.13+esm62.7.17-1~18.04ubuntu1.13+esm72.7.17-1~18.04ubuntu1.13+esm82.7.17-1~18.04ubuntu1.13+esm102.7.17-1~18.04ubuntu1.13+esm112.7.17-1~18.04ubuntu1.13+esm122.7.17-1~18.04ubuntu1.13+esm132.7.17-1~18.04ubuntu1.13+esm142.7.17-1~18.04ubuntu1.13+esm15 |
None known |
python3.6Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.6.3-1ubuntu13.6.4~rc1-13.6.4~rc1-23.6.4-13.6.4-2 Show 31 moreShow less3.6.4-3build13.6.4-43.6.5~rc1-13.6.5-33.6.6-1~18.043.6.7-1~18.043.6.8-1~18.04.13.6.8-1~18.04.23.6.8-1~18.04.33.6.9-1~18.043.6.9-1~18.04ubuntu13.6.9-1~18.04ubuntu1.13.6.9-1~18.04ubuntu1.33.6.9-1~18.04ubuntu1.43.6.9-1~18.04ubuntu1.63.6.9-1~18.04ubuntu1.73.6.9-1~18.04ubuntu1.83.6.9-1~18.04ubuntu1.93.6.9-1~18.04ubuntu1.103.6.9-1~18.04ubuntu1.123.6.9-1~18.04ubuntu1.133.6.9-1~18.04ubuntu1.13+esm13.6.9-1~18.04ubuntu1.13+esm23.6.9-1~18.04ubuntu1.13+esm33.6.9-1~18.04ubuntu1.13+esm43.6.9-1~18.04ubuntu1.13+esm53.6.9-1~18.04ubuntu1.13+esm63.6.9-1~18.04ubuntu1.13+esm73.6.9-1~18.04ubuntu1.13+esm83.6.9-1~18.04ubuntu1.13+esm93.6.9-1~18.04ubuntu1.13+esm10 |
None known |
python3.7Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.7.0~a2-13.7.0~a3-13.7.0~a3-23.7.0~a3-33.7.0~a4-1 Show 21 moreShow less3.7.0~b1-13.7.0~b1-1build13.7.0~b2-13.7.0~b3-13.7.0-1~18.043.7.1-1~18.043.7.3-2~18.04.13.7.5-2~18.043.7.5-2~18.04.43.7.5-2ubuntu1~18.04.23.7.5-2ubuntu1~18.04.2+esm13.7.5-2ubuntu1~18.04.2+esm23.7.5-2ubuntu1~18.04.2+esm33.7.5-2ubuntu1~18.04.2+esm43.7.5-2ubuntu1~18.04.2+esm53.7.5-2ubuntu1~18.04.2+esm63.7.5-2ubuntu1~18.04.2+esm73.7.5-2ubuntu1~18.04.2+esm83.7.5-2ubuntu1~18.04.2+esm93.7.5-2ubuntu1~18.04.2+esm103.7.5-2ubuntu1~18.04.2+esm11 |
None known |
python3.8Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.8.0-3~18.043.8.0-3~18.04.13.8.0-3ubuntu1~18.04.23.8.0-3ubuntu1~18.04.2+esm13.8.0-3ubuntu1~18.04.2+esm2 Show 9 moreShow less3.8.0-3ubuntu1~18.04.2+esm33.8.0-3ubuntu1~18.04.2+esm43.8.0-3ubuntu1~18.04.2+esm53.8.0-3ubuntu1~18.04.2+esm63.8.0-3ubuntu1~18.04.2+esm73.8.0-3ubuntu1~18.04.2+esm83.8.0-3ubuntu1~18.04.2+esm93.8.0-3ubuntu1~18.04.2+esm103.8.0-3ubuntu1~18.04.2+esm11 |
None known |
python3.8Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.8.0-13.8.0-23.8.0-33.8.0-43.8.0-5 Show 34 moreShow less3.8.1-2ubuntu33.8.2~rc1-1ubuntu13.8.2-13.8.2-1ubuntu13.8.2-1ubuntu1.13.8.2-1ubuntu1.23.8.5-1~20.043.8.5-1~20.04.23.8.5-1~20.04.33.8.10-0ubuntu1~20.043.8.10-0ubuntu1~20.04.13.8.10-0ubuntu1~20.04.23.8.10-0ubuntu1~20.04.43.8.10-0ubuntu1~20.04.53.8.10-0ubuntu1~20.04.63.8.10-0ubuntu1~20.04.73.8.10-0ubuntu1~20.04.83.8.10-0ubuntu1~20.04.93.8.10-0ubuntu1~20.04.103.8.10-0ubuntu1~20.04.113.8.10-0ubuntu1~20.04.123.8.10-0ubuntu1~20.04.133.8.10-0ubuntu1~20.04.143.8.10-0ubuntu1~20.04.153.8.10-0ubuntu1~20.04.163.8.10-0ubuntu1~20.04.173.8.10-0ubuntu1~20.04.183.8.10-0ubuntu1~20.04.18+esm13.8.10-0ubuntu1~20.04.18+esm23.8.10-0ubuntu1~20.04.18+esm33.8.10-0ubuntu1~20.04.18+esm43.8.10-0ubuntu1~20.04.18+esm53.8.10-0ubuntu1~20.04.18+esm63.8.10-0ubuntu1~20.04.18+esm7 |
None known |
python2.7Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.7.17~rc1-12.7.17-12.7.17-1ubuntu52.7.17-1ubuntu62.7.18~rc1-2 Show 22 moreShow less2.7.18-1~20.042.7.18-1~20.04.12.7.18-1~20.04.1+esm12.7.18-1~20.04.32.7.18-1~20.04.3+esm12.7.18-1~20.04.42.7.18-1~20.04.4+esm12.7.18-1~20.04.4+esm22.7.18-1~20.04.4+esm32.7.18-1~20.04.52.7.18-1~20.04.5+esm12.7.18-1~20.04.5+esm22.7.18-1~20.04.62.7.18-1~20.04.6+esm12.7.18-1~20.04.72.7.18-1~20.04.7+esm32.7.18-1~20.04.7+esm42.7.18-1~20.04.7+esm62.7.18-1~20.04.7+esm72.7.18-1~20.04.7+esm82.7.18-1~20.04.7+esm92.7.18-1~20.04.7+esm10 |
None known |
python3.9Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.9.0~rc1-1~20.043.9.0-5~20.043.9.5-3~20.04.13.9.5-3ubuntu0~20.04.13.9.5-3ubuntu0~20.04.1+esm1 Show 10 moreShow less3.9.5-3ubuntu0~20.04.1+esm23.9.5-3ubuntu0~20.04.1+esm33.9.5-3ubuntu0~20.04.1+esm43.9.5-3ubuntu0~20.04.1+esm53.9.5-3ubuntu0~20.04.1+esm63.9.5-3ubuntu0~20.04.1+esm73.9.5-3ubuntu0~20.04.1+esm83.9.5-3ubuntu0~20.04.1+esm93.9.5-3ubuntu0~20.04.1+esm103.9.5-3ubuntu0~20.04.1+esm11 |
None known |
python3.10Ubuntu:22.04:LTS |
All versions, plus listed versions 3.10.0-23.10.0-33.10.0-43.10.0-53.10.0-5build1 Show 30 moreShow less3.10.1-13.10.1-23.10.2-13.10.2-53.10.2-73.10.3-13.10.4-33.10.4-3ubuntu0.13.10.6-1~22.043.10.6-1~22.04.13.10.6-1~22.04.23.10.6-1~22.04.2ubuntu13.10.6-1~22.04.2ubuntu1.13.10.12-1~22.04.23.10.12-1~22.04.33.10.12-1~22.04.43.10.12-1~22.04.53.10.12-1~22.04.63.10.12-1~22.04.73.10.12-1~22.04.83.10.12-1~22.04.93.10.12-1~22.04.103.10.12-1~22.04.113.10.12-1~22.04.123.10.12-1~22.04.133.10.12-1~22.04.143.10.12-1~22.04.153.10.12-1~22.04.163.10.12-1~22.04.173.10.12-1~22.04.18 |
None known |
python2.7Ubuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.7.18-8build12.7.18-132.7.18-13ubuntu12.7.18-13ubuntu1.12.7.18-13ubuntu1.1+esm2 Show 16 moreShow less2.7.18-13ubuntu1.22.7.18-13ubuntu1.2+esm12.7.18-13ubuntu1.2+esm22.7.18-13ubuntu1.2+esm32.7.18-13ubuntu1.32.7.18-13ubuntu1.3+esm12.7.18-13ubuntu1.42.7.18-13ubuntu1.4+esm12.7.18-13ubuntu1.52.7.18-13ubuntu1.5+esm22.7.18-13ubuntu1.5+esm32.7.18-13ubuntu1.5+esm52.7.18-13ubuntu1.5+esm62.7.18-13ubuntu1.5+esm72.7.18-13ubuntu1.5+esm82.7.18-13ubuntu1.5+esm9 |
None known |
python3.11Ubuntu:Pro:22.04:LTS |
All versions, plus listed versions 3.11.0~rc1-1~22.043.11.0~rc1-1~22.04.1~esm13.11.0~rc1-1~22.04.1~esm23.11.0~rc1-1~22.04.1~esm33.11.0~rc1-1~22.04.1~esm4 Show 8 moreShow less3.11.0~rc1-1~22.04.1~esm53.11.0~rc1-1~22.04.1~esm63.11.0~rc1-1~22.04.1~esm73.11.0~rc1-1~22.04.1~esm83.11.0~rc1-1~22.04.1~esm93.11.0~rc1-1~22.04.13.11.0~rc1-1~22.04.1+esm13.11.0~rc1-1~22.04.1+esm2 |
None known |
python3.12Ubuntu:24.04:LTS |
All versions, plus listed versions 3.12.0-13.12.0-53.12.0-63.12.0-73.12.1-2 Show 21 moreShow less3.12.2-13.12.2-4build33.12.2-4build43.12.2-5ubuntu33.12.3-13.12.3-1ubuntu0.13.12.3-1ubuntu0.23.12.3-1ubuntu0.33.12.3-1ubuntu0.43.12.3-1ubuntu0.53.12.3-1ubuntu0.63.12.3-1ubuntu0.73.12.3-1ubuntu0.83.12.3-1ubuntu0.93.12.3-1ubuntu0.103.12.3-1ubuntu0.113.12.3-1ubuntu0.123.12.3-1ubuntu0.133.12.3-1ubuntu0.153.12.3-1ubuntu0.163.12.3-1ubuntu0.17 |
None known |
python3.14Ubuntu:26.10 |
All versions, plus listed versions 3.14.4-13.14.6-13.14.7-1ubuntu13.14.7-4ubuntu13.14.7-4ubuntu23.14.7-5ubuntu13.14.8-1ubuntu1 |
None known |
python3.14Ubuntu:26.04:LTS |
All versions, plus listed versions 3.14.0-13.14.0-23.14.0-43.14.2-13.14.3-1 Show 6 moreShow less3.14.3-23.14.3-33.14.3-53.14.4-13.14.4-1ubuntu0.13.14.4-1ubuntu0.2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-57178 is a high vulnerability (CVSS 7.4) in Python-social-auth Social-core, published September 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. Fixed in social-auth-core 5.0.0.
References
github.com/python-social-auth/social-core/security/advisories/GHSA-3c93-f73f-qc9h
nvd.nist.gov/vuln/detail/CVE-2026-57178