# CVE-2026-57175: python-social-auth social-auth-core SAML authentication bypass

Source: https://junglewise.ai/threats/cve-2026-57175-python-social-auth-social-auth-core-saml-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-57175 · Severity: medium · CVSS 6.4 · Published 2026-09-24

social-auth-core is a Python library that provides SAML-based single sign-on authentication for web applications. The library's SAML backend failed to verify that incoming SAML responses were genuine responses to previously issued authentication requests, allowing attackers with valid credentials at a trusted identity provider to hijack logged-in users' accounts by linking their own SAML identity to the victim's local account.

Technologies: [social-auth-core (PyPI)](https://junglewise.ai/threats/technologies/social-auth-core). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-57175 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57175 being exploited in the wild.

**How severe is CVE-2026-57175?** Medium severity, with a CVSS score of 6.4, published 24 September 2026.

**Which products and versions are affected?** social-auth-core (PyPI) < 5.0.0, ECOSYSTEM:introduced=0,fixed=5.0.0.

**Is there a fix for CVE-2026-57175?** Yes. social-auth-core (PyPI): upgrade to 5.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57175 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-57175?** Check whether you run social-auth-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- social-auth-core (PyPI): upgrade to 5.0.0 or later

  ```sh
  pip install "social-auth-core>=5.0.0"
  ```


## Technical details

The vulnerability is an authentication bypass (CWE-287) in the SAML backend's Assertion Consumer Service (ACS) endpoint. The root cause is missing validation: the backend accepted and processed SAML responses without verifying they matched a previously issued AuthnRequest ID. An attacker with a valid account at a trusted IdP can craft a SAML response and send it to the ACS endpoint of a vulnerable application. If a victim is logged into that application, the attacker can trigger account association to link their SAML identity to the victim's account, then authenticate as the victim via SAML. The attack requires low privileges (valid IdP account), user interaction (victim's session), but is network-reachable. The fix validates incoming SAML responses against stored AuthnRequest IDs. Patch available in version 5.0.0.

## Affected products

- python-social-auth social-auth-core < 5.0.0

## Identifiers

- CVE-2026-57175
- GHSA-vq6g-g6c7-5f2j
- PYSEC-2026-4167

## Timeline

- 2026-09-24: disclosed
- 2026-09-24: patched: Fixed in version 5.0.0

## References

- [https://api.github.com/users/mauriceng98](https://api.github.com/users/mauriceng98)

## Related threats

- [Python Social Auth OpenID Connect nonce reuse](https://junglewise.ai/threats/cve-2026-115910-python-social-auth-is-a-social-authentication-and-registration)
- [Python Social Auth login CSRF in LINE backend](https://junglewise.ai/threats/cve-2026-62322-python-social-auth-login-csrf-in-line-backend-lineoauth2-missing)
- [python-social-auth social-auth-core session fixation in partial pipeline resume](https://junglewise.ai/threats/cve-2026-57179-python-social-auth-social-auth-core-session-fixation-in-partial)
- [python-social-auth social-core VK App backend auth bypass](https://junglewise.ai/threats/cve-2026-57178-python-social-auth-social-core-vk-app-backend-auth-bypass)
- [python-social-auth social-core login CSRF in LoginRadius backend](https://junglewise.ai/threats/cve-2026-57177-python-social-auth-social-core-login-csrf-in-loginradius-backend)