CVE-2024-32879 social-auth-app-django Improper Handling of Case Sensitivity vulnerability
Attackers can hijack accounts by exploiting case-insensitive database collation to match different user IDs, affecting Python Social Auth users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-32879?
CVE-2024-32879 is a medium-severity authentication bypass vulnerability in python-social-auth social-app-django, published on 24 Apr 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. This issue has been addressed by a fix released in version 5.4.1. An immediate workaround would be to change collation of the affected field.
Which versions are affected by CVE-2024-32879?
3 open source packages ship an affected version, including social-auth-app-django.
| Package | Affected | Fixed in |
|---|---|---|
social-auth-app-django PyPI | All versions | 5.4.1 |
social-auth-app-django PyPI | All versions | 5.4.1 |
social-auth-app-django PyPI | All versions | 5.4.1 |
Linux distribution packages (2)
python-social-auth-app-django openSUSE:Tumbleweed | All versions | 5.4.1-1.1 |
python-social-auth-app-django openSUSE:Tumbleweed | All versions | 5.9.0-1.2 |
How do I fix CVE-2024-32879?
Upgrade social-auth-app-django to 5.4.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-32879 being exploited?
There is no known exploitation of CVE-2024-32879 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-32879, GHSA-2gr8-3wc7-xhj3, PYSEC-2026-1931, UBUNTU-CVE-2024-32879, openSUSE-SU-2024:14036-1, openSUSE-SU-2026:12043-1.