Executive brief
The python-social-auth library's VK (VKontakte) App authentication backend failed to verify callback signatures when the auth_key parameter was missing. An attacker could forge authentication data and impersonate any VK user by submitting unsigned callback requests, leading to account takeover in applications using this backend.
Technical details
The vulnerability is an improper cryptographic signature verification flaw (CWE-347) combined with an authentication bypass (CWE-287) in the VKAppOAuth2 backend. When the auth_key parameter was omitted from VK application callbacks, the backend accepted unsigned attacker-controlled data without validating the cryptographic signature, allowing an attacker to forge callback fields like viewer_id, access_token, api_id, and api_result. Attack surface requires network access to the application's authentication endpoint; no user interaction or elevated privileges are needed. The vulnerability has been patched in version 5.0.0 by enforcing mandatory presence and validity of auth_key before trusting callback data.
Affected products
- python-social-auth social-core < 5.0.0
Timeline
- 2026-09-24: disclosed
- 2026-09-24: patched: Version 5.0.0 released with fix