{"id":"CVE-2026-62322","aliases":["DEBIAN-CVE-2026-62322","EUVD-2026-102323","GHSA-526j-582w-7fm9","UBUNTU-CVE-2026-62322"],"status":"published","title":"Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)","description":"Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resulting callback URL, causing the application to log the victim into the attacker's account. When account linking is enabled, the same missing validation can link the attacker's LINE identity to the victim's existing account and create a persistent unauthorized login path. Only applications with the LINE backend enabled are affected. This issue is fixed in version 5.0.2.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00153,"percentile":0.04538,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2026-10-15T18:45:06Z","modified":"2026-10-30T02:30:23Z","fixes":[{"ecosystem":"PyPI","package":"social-auth-core","fixed_in":["5.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"social-auth-core","fixed_in":["5.0.2-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"social-auth-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"social-auth-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.0-1","4.4.2-1","4.4.2-2","4.5.3-1","4.5.4-1","4.5.6-1","4.6.1-1","4.8.1-1","4.8.3-1","4.8.5-1","4.8.7-1","4.9.1-1","5.0.2-1","5.1.0-1","5.1.0-2","5.1.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"social-auth-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.6.1-1","4.8.1-1","4.8.3-1","4.8.5-1","4.8.7-1","4.9.1-1","5.0.2-1","5.1.0-1","5.1.0-2","5.1.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"social-auth-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-1"}]}],"versions":["4.6.1-1","4.8.1-1","4.8.3-1","4.8.5-1","4.8.7-1","4.9.1-1"]},{"source":"osv","ecosystem":"PyPI","package":"social-auth-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2"}]}],"versions":["0.0.1","0.1.0","0.2.0","0.2.1","1.0.0","1.0.1","1.1.0","1.2.0","1.3.0","1.4.0","1.5.0","1.6.0","1.7.0","2.0.0","3.0.0","3.1.0","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","4.0.2","4.0.3","4.1.0","4.2.0","4.3.0","4.4.0","4.4.1","4.4.2","4.5.0","4.5.1","4.5.2","4.5.3","4.5.4","4.5.5","4.5.6","4.6.0","4.6.1","4.7.0","4.8.0","4.8.1","4.8.2","4.8.3","4.8.4","4.8.5","4.8.6","4.8.7","4.9.0","4.9.1","5.0.0","5.0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"social-auth-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"social-auth-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.0-1.1","4.1.0-1","4.2.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"social-auth-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.2-2","4.5.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"social-auth-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.6.1-1","4.8.1-1","4.8.3-1"]}],"products":[{"vendor":"python-social-auth","product":"social-core"}],"references":[{"url":"https://github.com/python-social-auth/social-core/security/advisories/GHSA-526j-582w-7fm9","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/python-social-auth/social-core/pull/1829","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/python-social-auth/social-core/commit/5b3b90d07ebccc1f5b076445b27ea35ec059764b","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/python-social-auth/social-core/releases/tag/5.0.2","tags":["x_refsource_MISC","web","report"]},{"url":"https://github.com/advisories/GHSA-526j-582w-7fm9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62322.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62322","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-62322","tags":["advisory"]},{"url":"https://github.com/python-social-auth/social-core","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-62322","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-62322","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-62322","title":"Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)","description":"Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resulting callback URL, causing the application to log the victim into the attacker's account. When account linking is enabled, the same missing validation can link the attacker's LINE identity to the victim's existing account and create a persistent unauthorized login path. Only applications with the LINE backend enabled are affected. This issue is fixed in version 5.0.2.","status":"published","published":"2026-10-15T18:45:06.452Z","modified":"2026-10-28T19:54:37.324Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:20:14.999906Z"}],"euvd":[{"id":"EUVD-2026-102323","description":"Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resulting callback URL, causing the application to log the victim into the attacker's account. When account linking is enabled, the same missing validation can link the attacker's LINE identity to the victim's existing account and create a persistent unauthorized login path. Only applications with the LINE backend enabled are affected. This issue is fixed in version 5.0.2.","status":"published","published":"2026-10-15T18:45:06Z","modified":"2026-10-28T19:54:37Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:18.841799Z"}],"ghsa":[{"id":"GHSA-526j-582w-7fm9","title":"Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)","description":"### Impact\n\nApplications using the LINE Login backend are vulnerable to login CSRF / forced authentication. An attacker can start a LINE authorization flow for an account they control and trick a victim into visiting the callback URL with the attacker’s authorization code. Because the LINE backend did not validate the returned OAuth state, the application could accept the forged callback and log the victim in as the attacker-controlled LINE account.\n\nIf account linking is enabled, the same flaw can allow an attacker to link their LINE identity to a victim’s existing authenticated account, creating a persistent unauthorized login path.\n\n### Patches\n* https://github.com/python-social-auth/social-core/pull/1829\n\n### Workarounds\n  Only applications that enable the LINE backend are affected.\n\n### Credits\n\nThanks to Ta Duc Thien and Duc Anh Nguyen for reproting this via GitHub.","status":"published","published":"2026-10-15T20:09:11Z","modified":"2026-10-15T20:09:12Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:41:31.175024Z"}],"nvd":[{"id":"CVE-2026-62322","description":"Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resulting callback URL, causing the application to log the victim into the attacker's account. When account linking is enabled, the same missing validation can link the attacker's LINE identity to the victim's existing account and create a persistent unauthorized login path. Only applications with the LINE backend enabled are affected. This issue is fixed in version 5.0.2.","status":"published","published":"2026-10-15T19:17:42.213Z","modified":"2026-10-28T20:18:28.53Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:12:59.751798Z"}],"osv":[{"id":"CVE-2026-62322","title":"Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)","description":"Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resulting callback URL, causing the application to log the victim into the attacker's account. When account linking is enabled, the same missing validation can link the attacker's LINE identity to the victim's existing account and create a persistent unauthorized login path. Only applications with the LINE backend enabled are affected. This issue is fixed in version 5.0.2.","status":"published","published":"2026-10-15T18:45:06.452Z","modified":"2026-10-30T02:30:23.771572648Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"DEBIAN-CVE-2026-62322","description":"Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resulting callback URL, causing the application to log the victim into the attacker's account. When account linking is enabled, the same missing validation can link the attacker's LINE identity to the victim's existing account and create a persistent unauthorized login path. Only applications with the LINE backend enabled are affected. This issue is fixed in version 5.0.2.","status":"published","published":"2026-10-15T19:17:42.213Z","modified":"2026-10-29T09:47:37.275659917Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"GHSA-526j-582w-7fm9","title":"Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)","description":"### Impact\n\nApplications using the LINE Login backend are vulnerable to login CSRF / forced authentication. An attacker can start a LINE authorization flow for an account they control and trick a victim into visiting the callback URL with the attacker’s authorization code. Because the LINE backend did not validate the returned OAuth state, the application could accept the forged callback and log the victim in as the attacker-controlled LINE account.\n\nIf account linking is enabled, the same flaw can allow an attacker to link their LINE identity to a victim’s existing authenticated account, creating a persistent unauthorized login path.\n\n### Patches\n* https://github.com/python-social-auth/social-core/pull/1829\n\n### Workarounds\n  Only applications that enable the LINE backend are affected.\n\n### Credits\n\nThanks to Ta Duc Thien and Duc Anh Nguyen for reproting this via GitHub.","status":"published","published":"2026-10-15T20:09:11Z","modified":"2026-10-15T20:15:04.436524406Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:37.528068Z"},{"id":"UBUNTU-CVE-2026-62322","description":"Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resulting callback URL, causing the application to log the victim into the attacker's account. When account linking is enabled, the same missing validation can link the attacker's LINE identity to the victim's existing account and create a persistent unauthorized login path. Only applications with the LINE backend enabled are affected. This issue is fixed in version 5.0.2.","status":"published","published":"2026-10-15T19:17:00Z","modified":"2026-10-28T17:38:17Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:43.630667Z"}]}}