CVE-2026-57175: python-social-auth social-auth-core SAML authentication bypass

CVE-2026-57175 · Severity: medium · CVSS 6.4 · Published 2026-09-24

social-auth-core is a Python library that provides SAML-based single sign-on authentication for web applications. The library's SAML backend failed to verify that incoming SAML responses were genuine responses to previously issued authentication requests, allowing attackers with valid credentials at a trusted identity provider to hijack logged-in users' accounts by linking their own SAML identity to the victim's local account.

Technologies: social-auth-core (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-57175 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57175 being exploited in the wild.
How severe is CVE-2026-57175?
Medium severity, with a CVSS score of 6.4, published 24 September 2026.
Which products and versions are affected?
social-auth-core (PyPI) < 5.0.0, ECOSYSTEM:introduced=0,fixed=5.0.0.
Is there a fix for CVE-2026-57175?
Yes. social-auth-core (PyPI): upgrade to 5.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57175 attacked?
It is attacked over the network.
Am I affected by CVE-2026-57175?
Check whether you run social-auth-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • social-auth-core (PyPI): upgrade to 5.0.0 or later
    pip install "social-auth-core>=5.0.0"

Technical details

The vulnerability is an authentication bypass (CWE-287) in the SAML backend's Assertion Consumer Service (ACS) endpoint. The root cause is missing validation: the backend accepted and processed SAML responses without verifying they matched a previously issued AuthnRequest ID. An attacker with a valid account at a trusted IdP can craft a SAML response and send it to the ACS endpoint of a vulnerable application. If a victim is logged into that application, the attacker can trigger account association to link their SAML identity to the victim's account, then authenticate as the victim via SAML. The attack requires low privileges (valid IdP account), user interaction (victim's session), but is network-reachable. The fix validates incoming SAML responses against stored AuthnRequest IDs. Patch available in version 5.0.0.

Affected products

  • python-social-auth social-auth-core < 5.0.0

Identifiers

  • CVE-2026-57175
  • GHSA-vq6g-g6c7-5f2j
  • PYSEC-2026-4167

Timeline

  • 2026-09-24: disclosed
  • 2026-09-24: patched: Fixed in version 5.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.