All vulnerabilities
CVE-2026-62322GHSA-526j-582w-7fm9

social-auth-core: Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

python-social-auth social-auth-corepipRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.0.2Fixed versionGitHub
Published15 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 5.0.2social-auth-core, pipGitHub
  • 5.0.2social-auth-core, PyPIOSVpip install "social-auth-core>=5.0.2"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Applications using the LINE Login backend are vulnerable to login CSRF / forced authentication. An attacker can start a LINE authorization flow for an account they control and trick a victim into visiting the callback URL with the attacker’s authorization code. Because the LINE backend did not validate the returned OAuth state, the application could accept the forged callback and log the victim in as the attacker-controlled LINE account.

If account linking is enabled, the same flaw can allow an attacker to link their LINE identity to a victim’s existing authenticated account, creating a persistent unauthorized login path.

Patches

  • https://github.com/python-social-auth/social-core/pull/1829

Workarounds

Only applications that enable the LINE backend are affected.

Credits

Thanks to Ta Duc Thien and Duc Anh Nguyen for reproting this via GitHub.

Text from GitHub Advisory Database

Affected versions 53

  • social-auth-core, pip< 5.0.2GitHub
  • social-coreaffected: < 5.0.2CVE List
  • social-auth-core, PyPIfrom first release, fixed in 5.0.2OSV
  • social-auth-core, PyPI0.0.1OSV
  • social-auth-core, PyPI0.1.0OSV
  • social-auth-core, PyPI0.2.0OSV
  • social-auth-core, PyPI0.2.1OSV
  • social-auth-core, PyPI1.0.0OSV
  • social-auth-core, PyPI1.0.1OSV
  • social-auth-core, PyPI1.1.0OSV
  • social-auth-core, PyPI1.2.0OSV
  • social-auth-core, PyPI1.3.0OSV
  • social-auth-core, PyPI1.4.0OSV
  • social-auth-core, PyPI1.5.0OSV
  • social-auth-core, PyPI1.6.0OSV
  • social-auth-core, PyPI1.7.0OSV
  • social-auth-core, PyPI2.0.0OSV
  • social-auth-core, PyPI3.0.0OSV
  • social-auth-core, PyPI3.1.0OSV
  • social-auth-core, PyPI3.2.0OSV
  • social-auth-core, PyPI3.3.0OSV
  • social-auth-core, PyPI3.3.1OSV
  • social-auth-core, PyPI3.3.2OSV
  • social-auth-core, PyPI3.3.3OSV
  • social-auth-core, PyPI3.4.0OSV
  • social-auth-core, PyPI4.0.2OSV
  • social-auth-core, PyPI4.0.3OSV
  • social-auth-core, PyPI4.1.0OSV
  • social-auth-core, PyPI4.2.0OSV
  • social-auth-core, PyPI4.3.0OSV
  • social-auth-core, PyPI4.4.0OSV
  • social-auth-core, PyPI4.4.1OSV
  • social-auth-core, PyPI4.4.2OSV
  • social-auth-core, PyPI4.5.0OSV
  • social-auth-core, PyPI4.5.1OSV
  • social-auth-core, PyPI4.5.2OSV
  • social-auth-core, PyPI4.5.3OSV
  • social-auth-core, PyPI4.5.4OSV
  • social-auth-core, PyPI4.5.5OSV
  • social-auth-core, PyPI4.5.6OSV
  • social-auth-core, PyPI4.6.0OSV
  • social-auth-core, PyPI4.6.1OSV
  • social-auth-core, PyPI4.7.0OSV
  • social-auth-core, PyPI4.8.0OSV
  • social-auth-core, PyPI4.8.1OSV
  • social-auth-core, PyPI4.8.2OSV
  • social-auth-core, PyPI4.8.3OSV
  • social-auth-core, PyPI4.8.4OSV
  • social-auth-core, PyPI4.8.5OSV
  • social-auth-core, PyPI4.8.6OSV
  • social-auth-core, PyPI4.8.7OSV
  • social-auth-core, PyPI4.9.0OSV
  • social-auth-core, PyPI4.9.1OSV

References 5