CVE-2026-57177 social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend
An attacker can force a victim's browser to authenticate as the attacker via LoginRadius due to missing state validation in the social-auth-core library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-57177?
CVE-2026-57177 is a medium-severity vulnerability in python-social-auth social-core, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victim authenticated as the attacker's LoginRadius identity. The issue affects only applications using the LoginRadius backend. The issue has been fixe in version 5.0.0 by enabling callback state validation for the LoginRadius backend.
Weakness: CWE-352
Which versions are affected by CVE-2026-57177?
3 open source packages ship an affected version, including social-auth-core.
| Package | Affected | Fixed in |
|---|---|---|
social-auth-core PyPI | All versions | 5.0.0 |
social-auth-core PyPI | All versions | 5.0.0 |
social-auth-core PyPI | All versions | 5.0.0 |
How do I fix CVE-2026-57177?
Upgrade social-auth-core to 5.0.0 or later.
Is CVE-2026-57177 being exploited?
There is no known exploitation of CVE-2026-57177 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-57177, GHSA-x7qq-23vw-7pfg, PYSEC-2026-4169, UBUNTU-CVE-2026-57177.