Python-Social-Auth

9 CVEs in 2 Python-Social-Auth products, including Social-Core, Social-App-Django. Newest: CVE-2026-115910 (2026-10-26).

Python-Social-Auth products with known CVEs

ProductCVEs
Social-Core7
Social-App-Django2
Python-Social-Auth CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-115910Medium6.82026-10-26Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in social_core/backends/open_id_connect.py uses get…
CVE-2026-62322Medium6.52026-10-15Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the r…
CVE-2026-57179Medium4.22026-09-24Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted `partial_token` as…
CVE-2026-57178High7.42026-09-24Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the `vk-app` backend accepted VK application callback data withou…
CVE-2026-57177Medium4.32026-09-24Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the a…
CVE-2026-57176Medium6.82026-09-24Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the…
CVE-2026-57175Medium6.42026-09-24Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consume…
CVE-2025-617832025-10-09Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail e…
CVE-2024-32879Medium4.92024-04-24Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB dat…