CVE-2026-57175— social-auth-core has an Improper Authentication issue
Quick assessment
Affected
python-social-auth social-core
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Python Social Auth 是一个社交认证/注册机制。在 5.0.0 版本之前，SAML 后端在断言消费者服务（Assertion Consumer Service, ACS）端点接收 SAML 响应时，未验证这些响应是否与先前发出的 匹配。使用该库中 SAML 账户关联功能的用户可能遭受攻击：具有受信任身份提供者（IdP）上有效账户的攻击者，可以将其 SAML 身份与已登录受害者的本地账户进行关联。随后，攻击者可通过 SAML 完成认证，进而访问受害者的账户。 该漏洞影响使用 SAML 后端并结合经认证
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-57175
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
social-auth-core has an Improper Authentication issue
Source: CVE Program / CVE List V5
Vulnerability Description
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued `AuthnRequest`. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML identity to a logged-in victim's local account. The attacker could then authenticate through SAML and gain access to the victim's account. The issue affects applications using the SAML backend together with authenticated account association. The issue has been fixed in version 5.0.0 by validating SAML responses against stored `AuthnRequest` IDs.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| python-social-auth | social-core | < 5.0.0 | - |
|
II. Public POCs for CVE-2026-57175
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57175
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-57175 (1)
Same Patch Batch · python-social-auth · 2026-09-24 · 5 CVEs total
| CVE-2026-57178 | 7.4 HIGH | social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing |
| CVE-2026-57176 | 6.8 MEDIUM | social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend |
| CVE-2026-57177 | 4.3 MEDIUM | social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend |
| CVE-2026-57179 | 4.2 MEDIUM | social-auth-core has a Session Fixation issue |
IV. Related Vulnerabilities
Same product: social-core
Same vendor: python-social-auth
-
CVE-2026-57179
social-auth-core has a Session Fixation issue -
CVE-2026-57178
social-auth-core: VK App backend accepts unsigned callback d -
CVE-2026-57177
social-auth-core has Login CSRF via Missing State Parameter -
CVE-2026-57176
social-auth-core Vulnerable to Account Takeover via Identity -
CVE-2025-61783
Python Social Auth - Django has unsafe account association
Same weakness: CWE-287
-
CVE-2026-101073
Netcore NR289-GE CGI Dispatcher boa improper authentication -
CVE-2026-52749
Improper Authentication in Kaon AR2140X -
CVE-2026-100886
Seetong T8108/T8108P/T8116/T8232 Debug Service improper auth -
CVE-2026-101050
Heym before 0.0.53 Authentication Bypass via Telegram Webhoo -
CVE-2026-101049
Heym before 0.0.53 Slack Webhook Signature Verification Bypa
V. Comments for CVE-2026-57175
No comments yet