Executive brief
social-core is a Python library that provides OAuth and social authentication support for web applications. The LoginRadius backend failed to validate OAuth state parameters during login, allowing attackers to hijack user sessions and cause victims to authenticate as the attacker's LoginRadius account. This affects only applications explicitly using the LoginRadius backend for authentication.
Technical details
The LoginRadius backend in social-core did not validate the OAuth state parameter during the authentication callback, a classic Cross-Site Request Forgery (CSRF) vulnerability in OAuth flows. An attacker could craft a malicious link containing an attacker-controlled LoginRadius token and trick a victim into clicking it; the victim's browser would then complete authentication using the attacker's credentials without state validation. The vulnerability requires user interaction (clicking a link) but no authentication or privileges. The fix enables state parameter validation for the LoginRadius backend. Versions prior to 5.0.0 are affected and should be upgraded immediately.
Affected products
- python-social-auth social-core < 5.0.0
Timeline
- 2026-09-24: disclosed: Published to GitHub Advisory Database
- 2026-09-24: patched: Version 5.0.0 released with fix