social-auth-core vulnerabilities (PyPI)
7 vulnerabilities.
-
social-auth-corePyPI Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim 6.8 Medium -
social-auth-corePyPI Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign) 6.5 Medium -
social-auth-corePyPI social-auth-core has a Session Fixation issue 4.2 Medium -
social-auth-corePyPI social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing 7.4 High -
social-auth-corePyPI social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend 4.3 Medium -
social-auth-corePyPI social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend 6.8 Medium -
social-auth-corePyPI social-auth-core has an Improper Authentication issue 6.4 Medium