CVE-2026-115910

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resulting callback URL, causing the application to log the victim into the attacker's account. When account linking is enabled, the same missing validation can link the attacker's LINE identity to the victim's existing account and create a persistent unauthorized login path.

In Python Social Auth prior to version 5.0.0, the partial-pipeline resume mechanism accepted partial_token as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow and cause a victim's browser to resume that attacker-controlled flow.

Python Social Auth prior to version 5.0.0 in the vk-app backend accepts VK callback data without verifying the signature when the auth_key parameter is omitted. An attacker can send unsigned attacker-controlled data and authenticate as an arbitrary VK user. The issue affects only applications using the vk-app backend. The fix in version 5.0.0 requires auth_key to be present and valid.

In Python Social Auth prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF, and an attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token.

In Python Social Auth prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table.

In Python Social Auth prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML identity to a logged-in victim's local account.

Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the associate_by_email pipeline was not included, potentially leading to account compromise when a third-party authentication service does not validate e-mail addresses or require unique ones. Version 5.6.0 contains a patch.