CVE-2026-57178 social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing
Attackers can bypass authentication in the VK App backend by omitting the auth_key, allowing them to impersonate arbitrary VK users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-57178?
CVE-2026-57178 is a high-severity authentication bypass vulnerability in python-social-auth social-core, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the `vk-app` backend accepted VK application callback data without verifying the callback signature when the `auth_key` parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as `viewer_id`, `access_token`, `api_id`, and `api_result`, potentially allowing authentication as an arbitrary VK user ID. The issue affects only applications using the `vk-app` backend. The issue has been fixed in version 5.0.0 by requiring `auth_key` to be present and valid before callback data is trusted.
Which versions are affected by CVE-2026-57178?
3 open source packages ship an affected version, including social-auth-core.
| Package | Affected | Fixed in |
|---|---|---|
social-auth-core PyPI | All versions | 5.0.0 |
social-auth-core PyPI | All versions | 5.0.0 |
social-auth-core PyPI | All versions | 5.0.0 |
How do I fix CVE-2026-57178?
Upgrade social-auth-core to 5.0.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-57178 being exploited?
There is no known exploitation of CVE-2026-57178 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-57178, GHSA-3c93-f73f-qc9h, PYSEC-2026-4165, UBUNTU-CVE-2026-57178.