CVE-2026-115910: Python Social Auth OpenID Connect nonce reuse

CVE-2026-115910 · Severity: medium · CVSS 6.8 · Published 2026-10-26

Python Social Auth is a library that enables users to log in to web applications using OpenID Connect providers. An attacker who intercepts a victim's authorization code can use it to log in as that victim on a different browser or device by reusing the victim's nonce, which is stored globally rather than tied to a specific login session. This could allow complete account takeover without the victim's knowledge.

Technologies: social-auth-core (PyPI). Vendors: PyPI, Python-Social-Auth.

Quick answers

Is CVE-2026-115910 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-115910 being exploited in the wild.
How severe is CVE-2026-115910?
Medium severity, with a CVSS score of 6.8, published 26 October 2026.
Which products and versions are affected?
social-auth-core (PyPI) <= 6.1.1, ECOSYSTEM:introduced=0,fixed=6.2.0; Python-Social-Auth Social-Auth-Core before 6.2.0.
Is there a fix for CVE-2026-115910?
Yes. social-auth-core (PyPI): upgrade to 6.2.0 or later. Until then: Enable DEFAULT_USE_PKCE in the OpenIdConnectAuth configuration to add PKCE protection, which binds the authorization code to the code_verifier and prevents code reuse. In-progress OIDC logins must be restarted after upgrading to 6.2.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115910 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-115910?
Check whether you run social-auth-core (PyPI) or Python-Social-Auth Social-Auth-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • social-auth-core (PyPI): upgrade to 6.2.0 or later
    pip install "social-auth-core>=6.2.0"

Enable DEFAULT_USE_PKCE in the OpenIdConnectAuth configuration to add PKCE protection, which binds the authorization code to the code_verifier and prevents code reuse. In-progress OIDC logins must be restarted after upgrading to 6.2.0.

Technical details

The OpenIdConnectAuth backend stores OpenID Connect nonces in a shared OpenIdConnectAssociation table and validates them only for existence and expiration rather than binding them to the initiating browser session and OAuth state. An attacker with access to a victim's authorization code can initiate their own login, obtain valid state for their browser, and submit the victim's code with that state; the nonce validation passes because the victim's nonce is globally available. With DEFAULT_USE_PKCE disabled (the default), the attacker can complete authentication as the victim.

Affected products

  • python-social-auth Social Auth Core before 6.2.0

Identifiers

  • CVE-2026-115910
  • GHSA-h2r5-x5m7-3935

Timeline

  • 2026-10-26: disclosed
  • 2026-10-20: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.