Quick answers
- Is CVE-2026-126775 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-126775 being exploited in the wild.
- How severe is CVE-2026-126775?
- Medium severity, with a CVSS score of 4.2, published 11 November 2026.
- Which products and versions are affected?
- Python Software Foundation Social-Auth-Core 4.7.0 before 7.0.0.
- Is there a fix for CVE-2026-126775?
- Yes: fixed in 7.0.0. Until then: In-progress SAML logins must be restarted after upgrading to 7.0.0. IdP-initiated login is disabled by default and requires explicit opt-in in the new version. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-126775 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-126775?
- Check whether you run Python Software Foundation Social-Auth-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 7.0.0
In-progress SAML logins must be restarted after upgrading to 7.0.0. IdP-initiated login is disabled by default and requires explicit opt-in in the new version.
Technical details
The SAML backend fails to validate that the unsigned RelayState parameter originates from the legitimate authentication flow, allowing an attacker to select an arbitrary session by crafting an auto-submitting form with their own IdP response and RelayState. The fix binds SAML and OpenID callbacks to the initiating browser session rather than allowing session selection via untrusted RelayState, and implements a same-origin return page to prevent cross-origin session hijacking.
Affected products
- Python Software Foundation social-auth-core 4.7.0 before 7.0.0
Timeline
- 2026-11-11: disclosed: CVE-2026-126775 published on NVD
- 2026-10-29: patched: Fix committed by Michal Čihař