CVE-2026-57176 python-social-auth CVE debrief

Who should care

Defenders managing applications using the Vend OAuth2 backend with multiple Vend shops should assess exposure and prioritize upgrading to Python Social Auth version 5.0.0. They should verify current authentication associations and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-57176 is a medium-severity issue in Python Social Auth's Vend OAuth2 backend prior to version 5.0.0, allowing for user authentication collisions across multiple Vend shops. Defenders managing such applications should verify exposure and prioritize upgrading to the patched version.

• User authentication collision across multiple Vend shops
• Potential unauthorized access to accounts across different shops
• Need for verification of current authentication associations
• Upgrade to version 5.0.0 to mitigate the issue

Technical summary

The Vend OAuth2 backend in Python Social Auth prior to version 5.0.0 used only the numeric Vend user_id as the social-auth UID. This allowed for authentication collisions across multiple Vend shops. The issue affects applications using the Vend OAuth2 backend with more than one Vend shop. Version 5.0.0 patches the issue by properly handling user IDs to prevent collisions. Defenders should prioritize verifying exposure in applications using the Vend OAuth2 backend with multiple Vend shops and upgrading to version 5.0.0.

Defensive priority

Defenders should prioritize verifying exposure in applications using the Vend OAuth2 backend with multiple Vend shops and upgrading to version 5.0.0.

Recommended defensive actions

• Verify if applications using the Vend OAuth2 backend have multiple Vend shops configured and assess exposure.
• Check the current Python Social Auth version and upgrade to 5.0.0 if necessary.
• Review authentication associations for potential collisions across different shops.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• technicalSummary

Evidence notes

The CVE Program and NVD indicate a medium-severity issue in Python Social Auth's Vend OAuth2 backend prior to version 5.0.0. Evidence from the CVE Program and NVD suggests that user authentication collisions across multiple Vend shops could occur due to the use of only the numeric Vend user_id as the social-auth UID. Defenders should verify the current authentication associations and assess exposure in applications using the Vend OAuth2 backend with multiple Vend shops.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.