CVE-2025-61783 Python Social Auth - Django has unsafe account association
Attackers can take over accounts by exploiting unsafe email association during authentication, even when the feature is disabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-61783?
CVE-2025-61783 is a medium-severity authentication bypass vulnerability in python-social-auth social-app-django, published on 9 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses. Version 5.6.0 contains a patch. As a workaround, review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.
Weakness: CWE-303
Which versions are affected by CVE-2025-61783?
3 open source packages ship an affected version, including social-auth-app-django.
| Package | Affected | Fixed in |
|---|---|---|
social-auth-app-django PyPI | All versions | 5.6.0 |
social-auth-app-django PyPI | All versions | 5.6.0 |
social-auth-app-django PyPI | All versions | 5.6.0 |
Linux distribution packages (1)
python-social-auth-app-django openSUSE:Tumbleweed | All versions | 5.7.0-1.1 |
How do I fix CVE-2025-61783?
Upgrade social-auth-app-django to 5.6.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-61783 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-61783 exists.
Sources
Also known as DEBIAN-CVE-2025-61783, GHSA-wv4w-6qv2-qqfg, PYSEC-2026-1932, UBUNTU-CVE-2025-61783, openSUSE-SU-2026:10499-1.