Quick answers
- Is CVE-2026-62322 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-62322 being exploited in the wild.
- How severe is CVE-2026-62322?
- Medium severity, with a CVSS score of 6.5, published 15 October 2026.
- Which products and versions are affected?
- social-auth-core (PyPI) < 5.0.2, ECOSYSTEM:introduced=0,fixed=5.0.2; Python-Social-Auth Social-Auth-Core < 5.0.2.
- Is there a fix for CVE-2026-62322?
- Yes. social-auth-core (PyPI): upgrade to 5.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-62322 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-62322?
- Check whether you run social-auth-core (PyPI) or Python-Social-Auth Social-Auth-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- social-auth-core (PyPI): upgrade to 5.0.2 or later
pip install "social-auth-core>=5.0.2"
Technical details
The vulnerability is a Cross-Site Request Forgery (CSRF) in the LineOAuth2 backend caused by missing OAuth state validation. An attacker can initiate a LINE authorization flow with their own account and trick a victim into clicking the callback URL with the attacker's authorization code; without state validation, the application accepts this forged callback. The attack requires user interaction (victim clicking a link) but requires no privileges or authentication from the attacker.
Affected products
- python-social-auth social-auth-core < 5.0.2
Identifiers
- CVE-2026-62322
- GHSA-526j-582w-7fm9
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched: Version 5.0.2 released
- 2026-10-15: advisory