All vulnerabilities
CVE-2026-57178GHSA-3c93-f73f-qc9hPYSEC-2026-4165

social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

python-social-auth social-auth-corepipRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
7.4High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.0.0Fixed versionGitHub
Published24 Sep 2026Updated 1 Oct 2026CVE List

What fixes it

  • 5.0.0social-auth-core, pipGitHub
  • 5.0.0social-auth-core, PyPIOSVpip install "social-auth-core>=5.0.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

The vk-app backend accepted VK application callback data without verifying the callback signature when the auth_key parameter was omitted.

Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as viewer_id, access_token, api_id, and api_result, potentially allowing authentication as an arbitrary VK user ID.

The issue affects only applications using the vk-app backend.

Patches

The issue has been fixed by requiring auth_key to be present and valid before callback data is trusted.

Users should upgrade to a patched version.

Fix:

  • https://github.com/python-social-auth/social-core/pull/1811

Workarounds

Applications that cannot upgrade immediately should disable the vk-app backend by removing social_core.backends.vk.VKAppOAuth2 from SOCIAL_AUTH_AUTHENTICATION_BACKENDS.

There is no complete workaround while continuing to use the vulnerable backend.

Credits

Reported by @lalalala5678 through GitHub private vulnerability reporting.

Text from GitHub Advisory Database

Affected versions 53

  • social-auth-core, pip< 5.0.0GitHub
  • social-coreaffected: < 5.0.0CVE List
  • social-auth-core, PyPIfrom first release, fixed in 5.0.0OSV
  • social-auth-core, PyPI0.0.1OSV
  • social-auth-core, PyPI0.1.0OSV
  • social-auth-core, PyPI0.2.0OSV
  • social-auth-core, PyPI0.2.1OSV
  • social-auth-core, PyPI1.0.0OSV
  • social-auth-core, PyPI1.0.1OSV
  • social-auth-core, PyPI1.1.0OSV
  • social-auth-core, PyPI1.2.0OSV
  • social-auth-core, PyPI1.3.0OSV
  • social-auth-core, PyPI1.4.0OSV
  • social-auth-core, PyPI1.5.0OSV
  • social-auth-core, PyPI1.6.0OSV
  • social-auth-core, PyPI1.7.0OSV
  • social-auth-core, PyPI2.0.0OSV
  • social-auth-core, PyPI3.0.0OSV
  • social-auth-core, PyPI3.1.0OSV
  • social-auth-core, PyPI3.2.0OSV
  • social-auth-core, PyPI3.3.0OSV
  • social-auth-core, PyPI3.3.1OSV
  • social-auth-core, PyPI3.3.2OSV
  • social-auth-core, PyPI3.3.3OSV
  • social-auth-core, PyPI3.4.0OSV
  • social-auth-core, PyPI4.0.2OSV
  • social-auth-core, PyPI4.0.3OSV
  • social-auth-core, PyPI4.1.0OSV
  • social-auth-core, PyPI4.2.0OSV
  • social-auth-core, PyPI4.3.0OSV
  • social-auth-core, PyPI4.4.0OSV
  • social-auth-core, PyPI4.4.1OSV
  • social-auth-core, PyPI4.4.2OSV
  • social-auth-core, PyPI4.5.0OSV
  • social-auth-core, PyPI4.5.1OSV
  • social-auth-core, PyPI4.5.2OSV
  • social-auth-core, PyPI4.5.3OSV
  • social-auth-core, PyPI4.5.4OSV
  • social-auth-core, PyPI4.5.5OSV
  • social-auth-core, PyPI4.5.6OSV
  • social-auth-core, PyPI4.6.0OSV
  • social-auth-core, PyPI4.6.1OSV
  • social-auth-core, PyPI4.7.0OSV
  • social-auth-core, PyPI4.8.0OSV
  • social-auth-core, PyPI4.8.1OSV
  • social-auth-core, PyPI4.8.2OSV
  • social-auth-core, PyPI4.8.3OSV
  • social-auth-core, PyPI4.8.4OSV
  • social-auth-core, PyPI4.8.5OSV
  • social-auth-core, PyPI4.8.6OSV
  • social-auth-core, PyPI4.8.7OSV
  • social-auth-core, PyPI4.9.0OSV
  • social-auth-core, PyPI4.9.1OSV

References 6