All vulnerabilities
CVE-2026-57179GHSA-vqg6-3fw6-j9jgPYSEC-2026-4168

social-auth-core has a Session Fixation issue

python-social-auth social-auth-corepipRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
4.2Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.0.0Fixed versionGitHub
Published24 Sep 2026Updated 1 Oct 2026CVE List

What fixes it

  • 5.0.0social-auth-core, pipGitHub
  • 5.0.0social-auth-core, PyPIOSVpip install "social-auth-core>=5.0.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

The partial-pipeline resume mechanism accepted partial_token as a bearer credential without binding it to the browser session that created it.

Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow, obtain a valid partial token and verification data, and cause a victim's browser to resume that attacker-controlled flow. This could authenticate the victim's browser as the attacker's account.

The issue affects applications using partial pipeline steps such as mail_validation or custom steps decorated with @partial.

Patches

The issue has been fixed by binding partial pipeline resumes to the originating browser session.

Users should upgrade to a patched version.

Fix:

  • https://github.com/python-social-auth/social-core/pull/1816
  • https://github.com/python-social-auth/social-docs/pull/444
  • https://github.com/python-social-auth/social-app-django/pull/1009

Workarounds

Applications that cannot upgrade immediately should disable resumable partial pipeline steps, including mail_validation and custom steps decorated with @partial.

If those flows are required, applications should avoid accepting partial resume links from untrusted contexts until a patched version can be deployed.

There is no complete workaround while continuing to use the vulnerable partial-pipeline resume mechanism.

Credits

Reported through GitHub private vulnerability reporting by Liyi Zhou, Ziyue Wang, Strick, Maurice, and Chenchen Yu from the University of Sydney security research team.

Reporter references:

  • https://lzhou1110.github.io/
  • https://zyy0530.github.io/
  • https://str1ckl4nd.github.io/
  • https://maurice.busystar.org/
  • https://7thparkk.github.io/

Text from GitHub Advisory Database

Affected versions 53

  • social-auth-core, pip< 5.0.0GitHub
  • social-coreaffected: < 5.0.0CVE List
  • social-auth-core, PyPIfrom first release, fixed in 5.0.0OSV
  • social-auth-core, PyPI0.0.1OSV
  • social-auth-core, PyPI0.1.0OSV
  • social-auth-core, PyPI0.2.0OSV
  • social-auth-core, PyPI0.2.1OSV
  • social-auth-core, PyPI1.0.0OSV
  • social-auth-core, PyPI1.0.1OSV
  • social-auth-core, PyPI1.1.0OSV
  • social-auth-core, PyPI1.2.0OSV
  • social-auth-core, PyPI1.3.0OSV
  • social-auth-core, PyPI1.4.0OSV
  • social-auth-core, PyPI1.5.0OSV
  • social-auth-core, PyPI1.6.0OSV
  • social-auth-core, PyPI1.7.0OSV
  • social-auth-core, PyPI2.0.0OSV
  • social-auth-core, PyPI3.0.0OSV
  • social-auth-core, PyPI3.1.0OSV
  • social-auth-core, PyPI3.2.0OSV
  • social-auth-core, PyPI3.3.0OSV
  • social-auth-core, PyPI3.3.1OSV
  • social-auth-core, PyPI3.3.2OSV
  • social-auth-core, PyPI3.3.3OSV
  • social-auth-core, PyPI3.4.0OSV
  • social-auth-core, PyPI4.0.2OSV
  • social-auth-core, PyPI4.0.3OSV
  • social-auth-core, PyPI4.1.0OSV
  • social-auth-core, PyPI4.2.0OSV
  • social-auth-core, PyPI4.3.0OSV
  • social-auth-core, PyPI4.4.0OSV
  • social-auth-core, PyPI4.4.1OSV
  • social-auth-core, PyPI4.4.2OSV
  • social-auth-core, PyPI4.5.0OSV
  • social-auth-core, PyPI4.5.1OSV
  • social-auth-core, PyPI4.5.2OSV
  • social-auth-core, PyPI4.5.3OSV
  • social-auth-core, PyPI4.5.4OSV
  • social-auth-core, PyPI4.5.5OSV
  • social-auth-core, PyPI4.5.6OSV
  • social-auth-core, PyPI4.6.0OSV
  • social-auth-core, PyPI4.6.1OSV
  • social-auth-core, PyPI4.7.0OSV
  • social-auth-core, PyPI4.8.0OSV
  • social-auth-core, PyPI4.8.1OSV
  • social-auth-core, PyPI4.8.2OSV
  • social-auth-core, PyPI4.8.3OSV
  • social-auth-core, PyPI4.8.4OSV
  • social-auth-core, PyPI4.8.5OSV
  • social-auth-core, PyPI4.8.6OSV
  • social-auth-core, PyPI4.8.7OSV
  • social-auth-core, PyPI4.9.0OSV
  • social-auth-core, PyPI4.9.1OSV

References 6