https://vulnerability.circl.lu/sightings/feed 2026-09-26T20:15:31.703167+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/375aae91-b1ca-4fac-8bda-82db392f3cce/export 2026-09-26T20:15:31.736339+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "375aae91-b1ca-4fac-8bda-82db392f3cce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57177", "type": "seen", "source": "https://gist.github.com/alon710/9eb459f948ad8f570083b5d465e5962c", "content": "# CVE-2026-57177: CVE-2026-57177: Login Cross-Site Request Forgery in python-social-auth (social-auth-core)\n\n> **CVSS Score:** 4.3\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-57177\n\n## Summary\nA Login Cross-Site Request Forgery (Login CSRF) vulnerability was discovered in the social-auth-core library prior to version 5.0.0 when utilizing the LoginRadius authentication backend. The backend explicitly disabled state token validation during the authentication callback, allowing attackers to link their identities to victim sessions.\n\n## TL;DR\nUnvalidated OAuth state in the LoginRadius backend of social-auth-core allows unauthenticated attackers to hijack victim sessions via Login CSRF.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-352\n- **Attack Vector**: Network\n- **CVSS Score**: 4.3 (Medium)\n- **EPSS Score**: N/A (Not actively indexed)\n- **Impact**: Integrity Loss (Identity mapping manipulation)\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- python-social-auth\n- social-auth-core\n- **social-auth-core**: < 5.0.0 (Fixed in: `5.0.0`)\n\n## Mitigation\n\n- Upgrade social-auth-core to version 5.0.0 or higher.\n- Disable the LoginRadius backend in the application settings if immediate patching is not possible.\n- Enforce SameSite=Lax cookie attribute to restrict cross-site credential transmission.\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade social-auth-core>=5.0.0' to update the library.\n2. Inspect configuration settings (e.g. Django settings.py) and remove 'social_core.backends.loginradius.LoginRadiusAuth' if patching is delayed.\n3. Restart the application services to apply the updated code or configuration.\n\n## References\n\n- [GitHub Security Advisory: GHSA-x7qq-23vw-7pfg](https://github.com/python-social-auth/social-core/security/advisories/GHSA-x7qq-23vw-7pfg)\n- [Pull Request #1808](https://github.com/python-social-auth/social-core/pull/1808)\n- [Fix Commit 4d332820e6b0583fde522956105a0e2beced5335](https://github.com/python-social-auth/social-core/commit/4d332820e6b0583fde522956105a0e2beced5335)\n- [social-core 5.0.0 Release](https://github.com/python-social-auth/social-core/releases/tag/5.0.0)\n- [NVD CVE-2026-57177 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-57177)\n- [CVE Org Portal CVE-2026-57177](https://www.cve.org/CVERecord?id=CVE-2026-57177)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-57177) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-24T23:30:32.000000Z"} 2026-09-24T23:30:32+00:00