Python-social-auth vulnerabilities

Products

• Social-core 7
• Social-app-django 2

Newest

• python-social-auth social-core Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim CVE-2026-115910 Fix available 6.8 MediumOctober 26, 2026
• python-social-auth social-core Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign) CVE-2026-62322 Fix available 6.5 MediumOctober 15, 2026
• python-social-auth social-core social-auth-core has a Session Fixation issue CVE-2026-57179 Fix available 4.2 MediumSeptember 24, 2026
• python-social-auth social-core social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing CVE-2026-57178 Fix available 7.4 HighSeptember 24, 2026
• python-social-auth social-core social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend CVE-2026-57177 Fix available 4.3 MediumSeptember 24, 2026
• python-social-auth social-core social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend CVE-2026-57176 Fix available 6.8 MediumSeptember 24, 2026
• python-social-auth social-core social-auth-core has an Improper Authentication issue CVE-2026-57175 Fix available 6.4 MediumSeptember 24, 2026
• python-social-auth social-app-django Python Social Auth - Django has unsafe account association CVE-2025-61783 Fix available 6.3 MediumOctober 9, 2025
• python-social-auth social-app-django social-auth-app-django Improper Handling of Case Sensitivity vulnerability CVE-2024-32879 Fix available 4.9 MediumApril 24, 2024