CVE-2026-57178 debrief: Python Social Auth vulnerability allows unsigned data to be treated as verified VK identity, potentially allowing authentication as an arbitrary VK user ID. The `vk-app` backend in Python Social Auth accepted unsigned VK application callback data when the `auth_key` parameter was omitted. This issue affects applications using the `vk-app` backend prior to version 5.0.0. Defenders o [truncated]
Python Social Auth, a social authentication/registration mechanism, had a vulnerability in its LoginRadius backend prior to version 5.0.0. The issue allowed for login CSRF due to the lack of OAuth state validation during the authentication flow. Applications using this backend were vulnerable, enabling an attacker to cause a victim's browser session to complete authentication using an attacker-controlled [truncated]
CVE-2026-57176 debrief: The Vend OAuth2 backend in Python Social Auth prior to version 5.0.0 incorrectly used only the numeric Vend user_id as the social-auth UID. This oversight allowed for user authentication collisions across multiple Vend shops. The issue arises when applications using the Vend OAuth2 backend are configured with more than one Vend shop. As a result, users from different shops with the [truncated]
CVE-2026-57175 is a vulnerability in the Python Social Auth library that allows an attacker to link their SAML identity to a logged-in victim's local account, potentially gaining access to the victim's account. The issue arises from the SAML backend accepting SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using S [truncated]
