CVE-2026-57179 social-auth-core has a Session Fixation issue

What is CVE-2026-57179?

CVE-2026-57179 is a medium-severity authentication bypass vulnerability in python-social-auth social-core, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted `partial_token` as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow, obtain a valid partial token and verification data, and cause a victim's browser to resume that attacker-controlled flow. This could authenticate the victim's browser as the attacker's account. The issue affects applications using partial pipeline steps such as `mail_validation` or custom steps decorated with `@partial`. The issue has been fixed in version 5.0.0 by binding partial pipeline resumes to the originating browser session.

Weakness: CWE-384

Which versions are affected by CVE-2026-57179?

3 open source packages ship an affected version, including social-auth-core.

How do I fix CVE-2026-57179?

Upgrade social-auth-core to 5.0.0 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-57179 being exploited?

There is no known exploitation of CVE-2026-57179 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-57179, GHSA-vqg6-3fw6-j9jg, PYSEC-2026-4168, UBUNTU-CVE-2026-57179.