{"schema":"threatline.record/2","record":{"id":"CVE-2026-115910","aliases":["GHSA-h2r5-x5m7-3935"],"summary":"Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim","details":"Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in social_core/backends/open_id_connect.py uses get_and_store_nonce to place the OpenID Connect nonce in a shared OpenIdConnectAssociation table, and get_nonce and validate_claims verify only that the nonce exists and has not expired rather than binding it to the browser session and OAuth state that initiated the login. An attacker who obtains a victim's unused authorization code can start a separate login to obtain valid state for the attacker's browser, submit the victim's code with that state, and pass nonce validation because the victim nonce is globally available. With DEFAULT_USE_PKCE disabled in the default OpenIdConnectAuth configuration, the attacker can be logged in as the victim. This issue is fixed in version 6.2.0.","categories":["Runtimes & languages"],"product":"social-core","vendor":"python-social-auth","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115910","source_modified_at":"2026-10-26T16:44:34.337Z","fetched_at":"2026-10-26T19:10:57.178988Z","product":"social-core","vendor":"python-social-auth","versions":[{"version":"< 6.2.0","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":6.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T16:44:34.337Z","modified_at":"2026-10-26T16:44:34.337Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115910","fetched_at":"2026-10-26T19:10:57.178988Z","source_modified_at":"2026-10-26T16:44:34.337Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/python-social-auth/social-core/security/advisories/GHSA-h2r5-x5m7-3935","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/python-social-auth/social-core/pull/2141","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/python-social-auth/social-core/commit/c2f2ae4663bef19ee8b07f2cf5a2344f9155d826","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/python-social-auth/social-core/releases/tag/6.2.0","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"vendor and product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-26T16:44:34.337Z","content_hash":"68d9f12ac80038841af98af498a9849f49472460d2759cea4f0cdb844ee14633"}}