# CVE-2026-57177: python-social-auth social-core login CSRF in LoginRadius backend

Source: https://junglewise.ai/threats/cve-2026-57177-python-social-auth-social-core-login-csrf-in-loginradius-backend  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-57177 · Severity: medium · CVSS 4.3 · Published 2026-09-24

social-core is a Python library that provides OAuth and social authentication support for web applications. The LoginRadius backend failed to validate OAuth state parameters during login, allowing attackers to hijack user sessions and cause victims to authenticate as the attacker's LoginRadius account. This affects only applications explicitly using the LoginRadius backend for authentication.

Technologies: [social-auth-core (PyPI)](https://junglewise.ai/threats/technologies/social-auth-core), [Python-Social-Auth Social-Core](https://junglewise.ai/threats/technologies/social-core). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Python-Social-Auth](https://junglewise.ai/threats/vendors/python-social-auth).

## Quick answers

**Is CVE-2026-57177 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57177 being exploited in the wild.

**How severe is CVE-2026-57177?** Medium severity, with a CVSS score of 4.3, published 24 September 2026.

**Which products and versions are affected?** social-auth-core (PyPI) < 5.0.0, ECOSYSTEM:introduced=0,fixed=5.0.0; Python-Social-Auth Social-Core < 5.0.0.

**Is there a fix for CVE-2026-57177?** Yes. social-auth-core (PyPI): upgrade to 5.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57177 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57177?** Check whether you run social-auth-core (PyPI) or Python-Social-Auth Social-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- social-auth-core (PyPI): upgrade to 5.0.0 or later

  ```sh
  pip install "social-auth-core>=5.0.0"
  ```


## Technical details

The LoginRadius backend in social-core did not validate the OAuth state parameter during the authentication callback, a classic Cross-Site Request Forgery (CSRF) vulnerability in OAuth flows. An attacker could craft a malicious link containing an attacker-controlled LoginRadius token and trick a victim into clicking it; the victim's browser would then complete authentication using the attacker's credentials without state validation. The vulnerability requires user interaction (clicking a link) but no authentication or privileges. The fix enables state parameter validation for the LoginRadius backend. Versions prior to 5.0.0 are affected and should be upgraded immediately.

## Affected products

- python-social-auth social-core < 5.0.0

## Identifiers

- CVE-2026-57177
- GHSA-x7qq-23vw-7pfg
- PYSEC-2026-4169

## Timeline

- 2026-09-24: disclosed: Published to GitHub Advisory Database
- 2026-09-24: patched: Version 5.0.0 released with fix

## References

- [https://api.github.com/users/mauriceng98](https://api.github.com/users/mauriceng98)

## Related threats

- [Python Social Auth OpenID Connect nonce reuse](https://junglewise.ai/threats/cve-2026-115910-python-social-auth-is-a-social-authentication-and-registration)
- [Python Social Auth login CSRF in LINE backend](https://junglewise.ai/threats/cve-2026-62322-python-social-auth-login-csrf-in-line-backend-lineoauth2-missing)
- [python-social-auth social-auth-core session fixation in partial pipeline resume](https://junglewise.ai/threats/cve-2026-57179-python-social-auth-social-auth-core-session-fixation-in-partial)
- [python-social-auth social-core VK App backend auth bypass](https://junglewise.ai/threats/cve-2026-57178-python-social-auth-social-core-vk-app-backend-auth-bypass)
- [python-social-auth social-core account takeover in Vend backend](https://junglewise.ai/threats/cve-2026-57176-python-social-auth-social-core-account-takeover-in-vend-backend)