CVE-2026-57175
MediumCVSS 6.4Summary
In Python Social Auth prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML identity to a logged-in victim's local account.
Risk Assessment
The attacker could then authenticate through SAML and gain access to the victim's account. The issue affects applications using the SAML backend together with authenticated account association.
Recommendation
Update Python Social Auth to version 5.0.0 or later, which validates SAML responses against stored AuthnRequest IDs. Check whether your application uses the SAML backend with account association.
Other vulnerabilities in Python Social Auth
See all- CVE-2026-57179Medium
In Python Social Auth prior to version 5.0.0, the partial-pipeline resume mechanism accepted partial_token as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow and cause a victim's browser to resume that attacker-controlled flow.
- CVE-2026-57178High
Python Social Auth prior to version 5.0.0 in the vk-app backend accepts VK callback data without verifying the signature when the auth_key parameter is omitted. An attacker can send unsigned attacker-controlled data and authenticate as an arbitrary VK user. The issue affects only applications using the vk-app backend. The fix in version 5.0.0 requires auth_key to be present and valid.
- CVE-2026-57177Medium
In Python Social Auth prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF, and an attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token.
- CVE-2026-57176Medium
In Python Social Auth prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table.
Original NVD description (English source)
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued `AuthnRequest`. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML identity to a logged-in victim's local account. The attacker could then authenticate through SAML and gain access to the victim's account. The issue affects applications using the SAML backend together with authenticated account association. The issue has been fixed in version 5.0.0 by validating SAML responses against stored `AuthnRequest` IDs.