What’s Vulnerable › Products

python-social-auth social-core vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your python-social-auth social-core version is affected

Latest python-social-auth social-core vulnerabilities

• CVE-2026-115910 — Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim (CVSS 6.8)
• CVE-2026-62322 — Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign) (CVSS 6.5)
• CVE-2026-57179 — social-auth-core has a Session Fixation issue (CVSS 4.2)
• CVE-2026-57178 — social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing (CVSS 7.4)
• CVE-2026-57177 — social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend (CVSS 4.3)
• CVE-2026-57176 — social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend (CVSS 6.8)
• CVE-2026-57175 — social-auth-core has an Improper Authentication issue (CVSS 6.4)