CVE-2026-57176
MediumCVSS 6.8Summary
In Python Social Auth prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table.
Risk Assessment
A user from one shop could be authenticated as the local account previously associated with the same numeric user ID from another shop. This leads to unauthorized access to another user's account.
Recommendation
Update Python Social Auth to version 5.0.0 or later, which patches the issue. Check whether your application uses the Vend OAuth2 backend with more than one Vend shop.
Other vulnerabilities in Python Social Auth
See all- CVE-2026-57179Medium
In Python Social Auth prior to version 5.0.0, the partial-pipeline resume mechanism accepted partial_token as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow and cause a victim's browser to resume that attacker-controlled flow.
- CVE-2026-57178High
Python Social Auth prior to version 5.0.0 in the vk-app backend accepts VK callback data without verifying the signature when the auth_key parameter is omitted. An attacker can send unsigned attacker-controlled data and authenticate as an arbitrary VK user. The issue affects only applications using the vk-app backend. The fix in version 5.0.0 requires auth_key to be present and valid.
- CVE-2026-57177Medium
In Python Social Auth prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF, and an attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token.
- CVE-2026-57175Medium
In Python Social Auth prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML identity to a logged-in victim's local account.
Original NVD description (English source)
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop. The issue affects applications using the Vend OAuth2 backend with more than one Vend shop. Version 5.0.0 patches the issue.