{"vulnerability": "cve-2026-57179", "sightings": [{"uuid": "1b08d855-50b4-4e29-b2a5-1b51a4569b82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57179", "type": "seen", "source": "https://gist.github.com/alon710/d6b528cbaf62fdf12beeb49959443071", "content": "# CVE-2026-57179: CVE-2026-57179: Session Fixation and Login CSRF in social-auth-core Partial Pipeline\n\n> **CVSS Score:** 4.2\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-57179\n\n## Summary\nCVE-2026-57179 is a critical Session Fixation and Login Cross-Site Request Forgery (CSRF) vulnerability in python-social-auth's core library (social-auth-core) prior to version 5.0.0. The vulnerability allows remote attackers to force arbitrary state transitions and bind third-party social credentials to a victim's session, leading to complete account takeover.\n\n## TL;DR\nUnauthenticated remote session fixation and login CSRF via unvalidated partial pipeline tokens in social-auth-core < 5.0.0 enables account takeover.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-384\n- **Attack Vector**: Network\n- **Attack Complexity**: High\n- **Privileges Required**: None\n- **User Interaction**: Required\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- python-social-auth ecosystem\n- social-auth-core < 5.0.0\n- social-app-django installations utilizing partial pipelines\n\n## Mitigation\n\n- Upgrade dependency social-auth-core to version 5.0.0 or higher.\n- Replace legacy @partial decorator with stateful @partial_step with secure defaults.\n- Require explicit user interaction / confirmation page for any cross-session (external) pipeline resume flows.\n\n**Remediation Steps:**\n1. Run pip install --upgrade social-auth-core>=5.0.0 to secure python-social-auth installations.\n2. Review custom pipelines for legacy @partial usages and migrate to @partial_step.\n3. Configure any pipeline step intended for email validation with allow_external_resume=True and verify confirmation template endpoints are correctly integrated.\n\n## References\n\n- [https://nvd.nist.gov/vuln/detail/CVE-2026-57179](https://nvd.nist.gov/vuln/detail/CVE-2026-57179)\n- [https://www.cve.org/CVERecord?id=CVE-2026-57179](https://www.cve.org/CVERecord?id=CVE-2026-57179)\n- [https://github.com/python-social-auth/social-core/security/advisories/GHSA-vqg6-3fw6-j9jg](https://github.com/python-social-auth/social-core/security/advisories/GHSA-vqg6-3fw6-j9jg)\n- [https://github.com/python-social-auth/social-core](https://github.com/python-social-auth/social-core)\n- [https://github.com/python-social-auth/social-core/commit/0418782454ac7bbc6a9230ea21f7f5066fe89686](https://github.com/python-social-auth/social-core/commit/0418782454ac7bbc6a9230ea21f7f5066fe89686)\n- [https://github.com/python-social-auth/social-core/pull/1816](https://github.com/python-social-auth/social-core/pull/1816)\n- [https://github.com/python-social-auth/social-app-django/pull/1009](https://github.com/python-social-auth/social-app-django/pull/1009)\n- [https://github.com/python-social-auth/social-docs/pull/444](https://github.com/python-social-auth/social-docs/pull/444)\n- [https://github.com/python-social-auth/social-core/releases/tag/5.0.0](https://github.com/python-social-auth/social-core/releases/tag/5.0.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-57179) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-24T21:30:35.000000Z"}]}