CVE-2026-57176: python-social-auth social-core account takeover in Vend backend

CVE-2026-57176 · Severity: medium · CVSS 6.8 · Published 2026-09-24

python-social-auth is a widely-used Python library for OAuth2 authentication. The Vend backend (used by applications integrating with Vend point-of-sale systems) failed to properly scope user identities, allowing users from one Vend shop to log in as accounts from another shop if both shops authenticated through the same application. This enables account takeover and unauthorized access to customer data and business systems.

Technologies: social-auth-core (PyPI), Python-Social-Auth Social-Core. Vendors: PyPI, Python-Social-Auth.

Quick answers

Is CVE-2026-57176 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57176 being exploited in the wild.
How severe is CVE-2026-57176?
Medium severity, with a CVSS score of 6.8, published 24 September 2026.
Which products and versions are affected?
social-auth-core (PyPI) < 5.0.0, ECOSYSTEM:introduced=0,fixed=5.0.0; Python-Social-Auth Social-Core < 5.0.0.
Is there a fix for CVE-2026-57176?
Yes. social-auth-core (PyPI): upgrade to 5.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57176 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-57176?
Check whether you run social-auth-core (PyPI) or Python-Social-Auth Social-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • social-auth-core (PyPI): upgrade to 5.0.0 or later
    pip install "social-auth-core>=5.0.0"

Technical details

The vulnerability is an authentication bypass (CWE-289) in the Vend OAuth2 backend. The backend used only the numeric user_id field as the unique identifier (UID) without scoping it to the shop, so when multiple Vend shops authenticated through a single application, users with matching IDs across different shops would collide in the social-auth association table. An attacker with an account in one Vend shop could use that account to authenticate as a user from another shop if both shared the same numeric ID. The flaw requires the application to support multiple Vend shops and allows network-accessible exploitation with low privileges (existing user account) and no user interaction. Patches are available in version 5.0.0 and later, which scope UIDs by shop.

Affected products

  • python-social-auth social-core < 5.0.0

Identifiers

  • CVE-2026-57176
  • GHSA-fp7w-m676-w7gc
  • PYSEC-2026-4166

Timeline

  • 2026-06-30: disclosed
  • 2026-06-30: patched: Version 5.0.0 released
  • 2026-09-24: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.