CVE-2026-57178: python-social-auth social-core VK App backend auth bypass

CVE-2026-57178 · Severity: high · CVSS 7.4 · Published 2026-09-24

The python-social-auth library's VK (VKontakte) App authentication backend failed to verify callback signatures when the auth_key parameter was missing. An attacker could forge authentication data and impersonate any VK user by submitting unsigned callback requests, leading to account takeover in applications using this backend.

Technologies: social-auth-core (PyPI), Python-Social-Auth Social-Core. Vendors: PyPI, Python-Social-Auth.

Quick answers

Is CVE-2026-57178 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57178 being exploited in the wild.
How severe is CVE-2026-57178?
High severity, with a CVSS score of 7.4, published 24 September 2026.
Which products and versions are affected?
social-auth-core (PyPI) < 5.0.0, ECOSYSTEM:introduced=0,fixed=5.0.0; Python-Social-Auth Social-Core < 5.0.0.
Is there a fix for CVE-2026-57178?
Yes. social-auth-core (PyPI): upgrade to 5.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57178 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-57178?
Check whether you run social-auth-core (PyPI) or Python-Social-Auth Social-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • social-auth-core (PyPI): upgrade to 5.0.0 or later
    pip install "social-auth-core>=5.0.0"

Technical details

The vulnerability is an improper cryptographic signature verification flaw (CWE-347) combined with an authentication bypass (CWE-287) in the VKAppOAuth2 backend. When the auth_key parameter was omitted from VK application callbacks, the backend accepted unsigned attacker-controlled data without validating the cryptographic signature, allowing an attacker to forge callback fields like viewer_id, access_token, api_id, and api_result. Attack surface requires network access to the application's authentication endpoint; no user interaction or elevated privileges are needed. The vulnerability has been patched in version 5.0.0 by enforcing mandatory presence and validity of auth_key before trusting callback data.

Affected products

  • python-social-auth social-core < 5.0.0

Identifiers

  • CVE-2026-57178
  • GHSA-3c93-f73f-qc9h
  • PYSEC-2026-4165

Timeline

  • 2026-09-24: disclosed
  • 2026-09-24: patched: Version 5.0.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.