Executive brief
social-auth-core is a Python library that provides SAML-based single sign-on authentication for web applications. The library's SAML backend failed to verify that incoming SAML responses were genuine responses to previously issued authentication requests, allowing attackers with valid credentials at a trusted identity provider to hijack logged-in users' accounts by linking their own SAML identity to the victim's local account.
Technical details
The vulnerability is an authentication bypass (CWE-287) in the SAML backend's Assertion Consumer Service (ACS) endpoint. The root cause is missing validation: the backend accepted and processed SAML responses without verifying they matched a previously issued AuthnRequest ID. An attacker with a valid account at a trusted IdP can craft a SAML response and send it to the ACS endpoint of a vulnerable application. If a victim is logged into that application, the attacker can trigger account association to link their SAML identity to the victim's account, then authenticate as the victim via SAML. The attack requires low privileges (valid IdP account), user interaction (victim's session), but is network-reachable. The fix validates incoming SAML responses against stored AuthnRequest IDs. Patch available in version 5.0.0.
Affected products
- python-social-auth social-auth-core < 5.0.0
Timeline
- 2026-09-24: disclosed
- 2026-09-24: patched: Fixed in version 5.0.0