CVE-2026-57176 json
social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend
published 2026-09-24 45 d ago modified 2026-10-01 38 d ago also GHSA-fp7w-m676-w7gc , PYSEC-2026-4166 , EUVD-2026-86310
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 12%
- public exploits
- 0
- none known
Summary
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop. The issue affects applications using the Vend OAuth2 backend with more than one Vend shop. Version 5.0.0 patches the issue.
Patch / fix
- pypi social-auth-core 5.0.0
- social-auth-core Debian 14 5.0.2-1
debian advisories DEBIAN-CVE-2026-57176
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-57176 updated cvss 6.8
social-auth-core: social-auth-core: Account takeover via Vend user ID collision
-
Red Hat Ansible Automation Platform 2 automation-controller 4.7.17-1.el9ap, python-social-auth-core 4.4.2-1.el9ap, python3x-social-auth-core 4.4.2-1.el8ap, ansible-automation-platform-24/hub-rhel8, ansible-automation-platform-25/hub-rhel8, ansible-automation-platform-26/hub-rhel9, +14 moreaffected: workaround, no fix available, no fix planned “Out of support scope”
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 41 d ago
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N |
| OSV | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | social-auth-core | <5.0.0 |
5.0.0 |
Affected products
- python-social-auth social-core
Classification
- Weakness
-
- CWE-289 Authentication Bypass by Alternate Name
References
-
github.com
/python-social-auth/social-core/pull/1795
web
-
github.com
/python-social-auth/social-core/commit/dee7ad1785877afd355dd6860598823d2631b76e
web
-
github.com
/python-social-auth/social-core/security/advisories/GHSA-fp7w-m676-w7gc
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-57176
advisory
-
github.com
/python-social-auth/social-core
package
-
github.com
/python-social-auth/social-core/releases/tag/5.0.0
web
-
pypi.org
/project/social-auth-core
package
-
github.com
/advisories/GHSA-fp7w-m676-w7gc
advisory
Sources
- CVE List CVE-2026-57176
- GitHub Advisory GHSA-fp7w-m676-w7gc
- NVD CVE-2026-57176
- OSV PYSEC-2026-4166
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.