CVE-2026-57177 python-social-auth CVE debrief

Who should care

Defenders responsible for applications using Python Social Auth's LoginRadius backend should assess their exposure and prioritize upgrading to version 5.0.0 or later. Security teams and developers maintaining social authentication mechanisms should verify their configurations and implement necessary security measures.

Why it matters

CVE-2026-57177 allows login CSRF in Python Social Auth's LoginRadius backend prior to version 5.0.0, enabling attackers to authenticate as victims. Defenders should verify exposure, prioritize upgrades, and implement compensating controls. Evidence is limited, requiring verification from official sources.

• An attacker could authenticate as a victim using an attacker-controlled LoginRadius token.
• Victim's browser session could be used to complete authentication without their knowledge or consent.
• Defenders need to verify their applications' configurations and upgrade to a secure version.
• Exposure requires verification from official sources due to limited information on affected versions and scope.

Technical summary

The LoginRadius backend in Python Social Auth prior to version 5.0.0 did not validate OAuth state during authentication, leading to a login CSRF vulnerability. An attacker could exploit this by causing a victim's browser session to authenticate using an attacker-controlled LoginRadius token, effectively making the victim authenticated as the attacker's LoginRadius identity. This vulnerability affects applications using the LoginRadius backend with Python Social Auth. Defenders should prioritize verifying their applications' use of the LoginRadius backend with Python Social Auth and upgrading to version 5.0.0 or later if vulnerable.

Defensive priority

Defenders should prioritize verifying their applications' use of the LoginRadius backend with Python Social Auth and upgrading to version 5.0.0 or later if vulnerable. They should also assess their exposure and implement compensating controls if immediate upgrade is not feasible.

Recommended defensive actions

• Verify if applications using Python Social Auth's LoginRadius backend are vulnerable (using version prior to 5.0.0).
• Upgrade vulnerable applications to Python Social Auth version 5.0.0 or later.
• Implement compensating controls for login CSRF if immediate upgrade is not feasible.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Python Social Auth's LoginRadius backend. The issue was fixed in version 5.0.0, which enables callback state validation. Evidence is limited, requiring verification from official sources. Affected scope and severity need validation. Defenders should verify their applications' configurations and upgrade to a secure version. Exposure requires verification from official sources due to limited information on affected versions and scope.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.