Executive brief
python-social-auth is a popular library used by web applications to handle user authentication via external social media and identity providers. A flaw in the partial pipeline resume mechanism allows an attacker to hijack a victim's browser session by tricking it into resuming an attacker-controlled authentication flow, potentially logging the victim in as the attacker's account.
Technical details
The vulnerability is a session fixation issue in the partial-pipeline resume mechanism of social-auth-core. The root cause is that the library accepted partial_token as a bearer credential without binding it to the browser session that originally created it. An attacker can start an authentication flow, obtain a valid partial token and verification data (e.g., from mail_validation or custom @partial-decorated steps), and then cause a victim's browser to resume that attacker-controlled flow. The attack requires the victim to click a malicious link or be socially engineered into resuming the flow. The issue has been patched by binding partial pipeline resumes to the originating browser session. Patches are available in social-core, social-app-django, and related repositories.
Affected products
- python-social-auth social-auth-core <unknown>
Timeline
- 2026-09-24: disclosed
- 2026-09-24: patched: Patches available in social-core PR #1816, social-app-django PR #1009, and social-docs PR #444