CVE-2026-57177: python-social-auth social-core login CSRF in LoginRadius backend

CVE-2026-57177 · Severity: medium · CVSS 4.3 · Published 2026-09-24

social-core is a Python library that provides OAuth and social authentication support for web applications. The LoginRadius backend failed to validate OAuth state parameters during login, allowing attackers to hijack user sessions and cause victims to authenticate as the attacker's LoginRadius account. This affects only applications explicitly using the LoginRadius backend for authentication.

Technologies: social-auth-core (PyPI), Python-Social-Auth Social-Core. Vendors: PyPI, Python-Social-Auth.

Quick answers

Is CVE-2026-57177 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57177 being exploited in the wild.
How severe is CVE-2026-57177?
Medium severity, with a CVSS score of 4.3, published 24 September 2026.
Which products and versions are affected?
social-auth-core (PyPI) < 5.0.0, ECOSYSTEM:introduced=0,fixed=5.0.0; Python-Social-Auth Social-Core < 5.0.0.
Is there a fix for CVE-2026-57177?
Yes. social-auth-core (PyPI): upgrade to 5.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57177 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-57177?
Check whether you run social-auth-core (PyPI) or Python-Social-Auth Social-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • social-auth-core (PyPI): upgrade to 5.0.0 or later
    pip install "social-auth-core>=5.0.0"

Technical details

The LoginRadius backend in social-core did not validate the OAuth state parameter during the authentication callback, a classic Cross-Site Request Forgery (CSRF) vulnerability in OAuth flows. An attacker could craft a malicious link containing an attacker-controlled LoginRadius token and trick a victim into clicking it; the victim's browser would then complete authentication using the attacker's credentials without state validation. The vulnerability requires user interaction (clicking a link) but no authentication or privileges. The fix enables state parameter validation for the LoginRadius backend. Versions prior to 5.0.0 are affected and should be upgraded immediately.

Affected products

  • python-social-auth social-core < 5.0.0

Identifiers

  • CVE-2026-57177
  • GHSA-x7qq-23vw-7pfg
  • PYSEC-2026-4169

Timeline

  • 2026-09-24: disclosed: Published to GitHub Advisory Database
  • 2026-09-24: patched: Version 5.0.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.