CVE-2026-57175 social-auth-core has an Improper Authentication issue

What is CVE-2026-57175?

CVE-2026-57175 is a medium-severity authentication bypass vulnerability in python-social-auth social-core, published on 24 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued `AuthnRequest`. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML identity to a logged-in victim's local account. The attacker could then authenticate through SAML and gain access to the victim's account. The issue affects applications using the SAML backend together with authenticated account association. The issue has been fixed in version 5.0.0 by validating SAML responses against stored `AuthnRequest` IDs.

Weakness: CWE-287

Which versions are affected by CVE-2026-57175?

3 open source packages ship an affected version, including social-auth-core.

How do I fix CVE-2026-57175?

Upgrade social-auth-core to 5.0.0 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-57175 being exploited?

There is no known exploitation of CVE-2026-57175 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-57175, GHSA-vq6g-g6c7-5f2j, PYSEC-2026-4167, UBUNTU-CVE-2026-57175.