{"metadata": {"vulnerability": "CVE-2026-57178", "count": 17, "kinds": {"milestone": 6, "sighting": 1, "kev": 0, "other": 10}, "linked_omitted": 0}, "data": [{"timestamp": "2026-06-24T01:47:55.286Z", "date_only": false, "value": "2026-06-24T01:47:55.286Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-57178", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-24T17:25:47.225Z", "date_only": false, "value": "2026-09-24T17:25:47.225Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-57178", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-24T17:25:47.225Z", "date_only": false, "value": "2026-09-24T17:25:47.225Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-57178", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-24T18:17:00Z", "date_only": false, "value": "2026-09-24T18:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-57178", "record": "UBUNTU-CVE-2026-57178", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-09-24T18:17:14Z", "date_only": false, "value": "2026-09-24T18:17:14Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-3C93-F73F-QC9H", "record": "GHSA-3C93-F73F-QC9H", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-09-24T18:17:14.970Z", "date_only": false, "value": "2026-09-24T18:17:14.970", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-57178", "record": "FKIE_CVE-2026-57178", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-09-24T19:57:22Z", "date_only": false, "value": "2026-09-24T19:57:22Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-3C93-F73F-QC9H", "record": "GHSA-3C93-F73F-QC9H", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-09-24T19:57:22Z", "date_only": false, "value": "2026-09-24T19:57:22Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-3C93-F73F-QC9H", "record": "GHSA-3C93-F73F-QC9H", "field": "modified", "linked_record": true}, {"timestamp": "2026-09-24T22:30:32Z", "date_only": false, "value": "2026-09-24T22:30:32.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/16f5dd43c99d69c085ca2b85bb1225f7", "record": "CVE-2026-57178", "field": "creation_timestamp", "uuid": "0f723776-b038-4479-9973-f4932e785087", "content": "# CVE-2026-57178: CVE-2026-57178: Authentication Bypass via Missing Signature Verification in social-auth-core\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-57178\n\n## Summary\nAn authentication bypass vulnerability exists in the VKontakte App backend of social-auth-core prior to version 5.0.0. The vulnerability allows remote attackers to bypass cryptographic signature verification and gain unauthorized access to arbitrary accounts by omitting the signature parameter.\n\n## TL;DR\nApplications using the vk-app authentication backend in social-auth-core < 5.0.0 fail to verify signatures if the auth_key parameter is completely omitted, allowing full account bypass via spoofed VKontakte user IDs.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287 / CWE-347\n- **Attack Vector**: Network\n- **CVSS Severity**: 7.4 (High)\n- **Impact**: Unauthenticated Account Takeover\n- **Exploit Status**: PoC / Conceptual\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Python Social Auth libraries running social-auth-core < 5.0.0\n- Django applications using social-auth-app-django with VKAppOAuth2 backend enabled\n- Flask and Webpy integrations configured to use VKAppOAuth2\n- **social-auth-core**: < 5.0.0 (Fixed in: `5.0.0`)\n\n## Mitigation\n\n- Upgrade the social-auth-core library to version 5.0.0 or later.\n- Disable the vulnerable VKAppOAuth2 backend from configuration settings if upgrades are blocked.\n- Fallback to the standard VKOAuth2 backend for VKontakte integrations.\n\n**Remediation Steps:**\n1. Open your dependency specification files (e.g., requirements.txt, Pipfile, poetry.lock).\n2. Modify the social-auth-core entry to point to version >= 5.0.0.\n3. Execute your package manager upgrade command (e.g., pip install --upgrade social-auth-core>=5.0.0).\n4. Inspect configuration settings for references to social_core.backends.vk.VKAppOAuth2 and verify its removal if on an older version.\n\n## References\n\n- [CVE Official Record](https://www.cve.org/CVERecord?id=CVE-2026-57178)\n- [NVD Page](https://nvd.nist.gov/vuln/detail/CVE-2026-57178)\n- [GitHub Security Advisory GHSA-3c93-f73f-qc9h](https://github.com/python-social-auth/social-core/security/advisories/GHSA-3c93-f73f-qc9h)\n- [Remediation Pull Request](https://github.com/python-social-auth/social-core/pull/1811)\n- [Vulnerability Fix Commit](https://github.com/python-social-auth/social-core/commit/1bfacdd0379e5eb46e169a99ab648b835e9bb6a2)\n- [Version 5.0.0 Release Notes](https://github.com/python-social-auth/social-core/releases/tag/5.0.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-57178) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/16f5dd43c99d69c085ca2b85bb1225f7"}, {"timestamp": "2026-09-28T17:34:29.013Z", "date_only": false, "value": "2026-09-28T17:34:29.013431Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-57178", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-28T17:34:29.013Z", "date_only": false, "value": "2026-09-28T17:34:29.013431Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-57178", "record": "FKIE_CVE-2026-57178", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-09-28T17:34:38.454Z", "date_only": false, "value": "2026-09-28T17:34:38.454Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-57178", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-28T17:34:38.454Z", "date_only": false, "value": "2026-09-28T17:34:38.454Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-57178", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-28T18:17:23.873Z", "date_only": false, "value": "2026-09-28T18:17:23.873", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-57178", "record": "FKIE_CVE-2026-57178", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-01T16:38:39.761Z", "date_only": false, "value": "2026-10-01T16:38:39.761759Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-4165", "record": "PYSEC-2026-4165", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-01T17:10:43.798Z", "date_only": false, "value": "2026-10-01T17:10:43.798424Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-4165", "record": "PYSEC-2026-4165", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-17T09:45:57Z", "date_only": false, "value": "2026-10-17T09:45:57Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-57178", "record": "UBUNTU-CVE-2026-57178", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-14T02:06:06.200Z", "anchors": {"origin": {"timestamp": "2026-09-24T17:25:47.225Z", "date_only": false, "value": "2026-09-24T17:25:47.225Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-57178", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-09-24T17:25:47.225Z", "date_only": false, "value": "2026-09-24T17:25:47.225Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-57178", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 4351218.975825, "hours": 1208.6719377291665, "days": 50.361330738715274, "min_seconds": 4351218.975825, "max_seconds": 4351218.975825, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-24T17:25:47.225Z", "date_only": false, "value": "2026-09-24T17:25:47.225Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-57178", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T02:06:06.200Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}