https://vulnerability.circl.lu/sightings/feed 2026-09-26T08:50:59.000892+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/fec50e2b-1f0c-4b5c-b56a-d116355ffc6b/export 2026-09-26T08:50:59.026948+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "fec50e2b-1f0c-4b5c-b56a-d116355ffc6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57176", "type": "seen", "source": "https://gist.github.com/alon710/090d1e653999ad37deef689582d25929", "content": "# CVE-2026-57176: CVE-2026-57176: Multi-Tenant Account Takeover via Identity Binding Collision in python-social-auth Vend Backend\n\n> **CVSS Score:** 6.8\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-57176\n\n## Summary\nAn identity binding collision vulnerability in the Vend OAuth2 backend of python-social-auth (social-core) before version 5.0.0 allows unauthenticated remote attackers to take over local accounts in multi-tenant configurations. The flaw stems from relying on shop-local numeric user IDs as global social-auth identifiers, leading to collisions when identical IDs exist across distinct tenants.\n\n## TL;DR\nMulti-tenant integrations of python-social-auth using the Vend OAuth2 backend are vulnerable to complete account takeover because the library incorrectly relies on non-unique, shop-local numeric user IDs for database mappings.\n\n## Technical Details\n\n- **CWE ID**: CWE-289\n- **Attack Vector**: Network\n- **CVSS v3.1**: 6.8\n- **Exploit Status**: No active public exploits\n- **KEV Status**: Not Listed\n- **Impact**: High Confidentiality, High Integrity (Account Takeover)\n\n## Affected Systems\n\n- Web applications integrating python-social-auth (social-core) with Vend OAuth2 backend\n- **social-core**: < 5.0.0 (Fixed in: `5.0.0`)\n\n## Mitigation\n\n- Upgrade the python-social-auth (social-core) dependency to version 5.0.0 or higher.\n- Convert the database column type for social-auth UIDs from integer to string to ensure support for composite, scoped keys.\n- Implement application-level domain-prefix whitelisting to disable multi-tenant routing if only a single tenant is trusted.\n\n**Remediation Steps:**\n1. Modify the application requirements file to specify social-auth-core>=5.0.0.\n2. Run database migrations for the social-auth mapping table (e.g., social_auth_usersocialauth) to change the 'uid' field to a string/varchar format.\n3. Verify that the legacy data migration executes properly during the first login of existing active users.\n4. Ensure any reverse-proxy or web application firewall (WAF) filters sanitize input for the 'domain_prefix' parameter.\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/python-social-auth/social-core/security/advisories/GHSA-fp7w-m676-w7gc)\n- [Fix Commit](https://github.com/python-social-auth/social-core/commit/dee7ad1785877afd355dd6860598823d2631b76e)\n- [Associated Pull Request](https://github.com/python-social-auth/social-core/pull/1795)\n- [GitHub Release 5.0.0](https://github.com/python-social-auth/social-core/releases/tag/5.0.0)\n- [CVE Record (CVE.org)](https://www.cve.org/CVERecord?id=CVE-2026-57176)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-57176) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T00:30:29.000000Z"} 2026-09-25T00:30:29+00:00