Executive brief
python-social-auth is a widely-used Python library for OAuth2 authentication. The Vend backend (used by applications integrating with Vend point-of-sale systems) failed to properly scope user identities, allowing users from one Vend shop to log in as accounts from another shop if both shops authenticated through the same application. This enables account takeover and unauthorized access to customer data and business systems.
Technical details
The vulnerability is an authentication bypass (CWE-289) in the Vend OAuth2 backend. The backend used only the numeric user_id field as the unique identifier (UID) without scoping it to the shop, so when multiple Vend shops authenticated through a single application, users with matching IDs across different shops would collide in the social-auth association table. An attacker with an account in one Vend shop could use that account to authenticate as a user from another shop if both shared the same numeric ID. The flaw requires the application to support multiple Vend shops and allows network-accessible exploitation with low privileges (existing user account) and no user interaction. Patches are available in version 5.0.0 and later, which scope UIDs by shop.
Affected products
- python-social-auth social-core < 5.0.0
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched: Version 5.0.0 released
- 2026-09-24: advisory