Vulnerability in Python-Social-Auth Social-App-Django

CVE-2025-61783

Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses. Version 5.6.0 contains a patch. As a workaround, review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.

Published · last modified .

EPSS exploit prediction

EPSS: 0.004 (34.2th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 34th percentile — 34.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2025-61783: held from 0.005 to 0.004.

EPSS over last 30 days · oldest: 0.005 · newest: 0.004 · change: -0.001

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2025-61783?
CVE-2025-61783 is a vulnerability in Python-Social-Auth Social-App-Django, classified under Incorrect Implementation of Authentication Algorithm. Published 2025-10-09.
Is CVE-2025-61783 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.