Python-Social-Auth Social-Core
7 CVEs affecting Python-Social-Auth Social-Core. Latest disclosed: 2026-10-26. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57178 | High | 7.4 | 2026-09-24 | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the `vk-app` backend accepted VK application callback data withou… |
CVE-2026-115910 | Medium | 6.8 | 2026-10-26 | Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in social_core/backends/open_id_connect.py uses get… |
CVE-2026-57176 | Medium | 6.8 | 2026-09-24 | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the… |
CVE-2026-62322 | Medium | 6.5 | 2026-10-15 | Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the r… |
CVE-2026-57175 | Medium | 6.4 | 2026-09-24 | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consume… |
CVE-2026-57177 | Medium | 4.3 | 2026-09-24 | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the a… |
CVE-2026-57179 | Medium | 4.2 | 2026-09-24 | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted `partial_token` as… |