Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

social-auth-core

7 known vulnerabilities (1 high, 6 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 1 high, 6 medium
Weekly downloads
1.3M
Dependents
125
Registry
PyPI

Advisories 7

  • CVE-2026-115910Medium 6.8

    Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the…

    Affected: fixed in 6.2.0.

  • CVE-2026-62322Medium 6.5

    Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

    Affected: fixed in 5.0.2.

  • CVE-2026-57179Medium 4.2

    social-auth-core has a Session Fixation issue

    Affected: fixed in 5.0.0.

  • social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

    Affected: fixed in 5.0.0.

  • CVE-2026-57177Medium 4.3

    social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

    Affected: fixed in 5.0.0.

  • CVE-2026-57176Medium 6.8

    social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend

    Affected: fixed in 5.0.0.

  • CVE-2026-57175Medium 6.4

    social-auth-core has an Improper Authentication issue

    Affected: fixed in 5.0.0.