Python Social Auth CVE-2026-62322

Exploitable only against applications that have the python-social-auth social-core LINE backend (LineOAuth2) enabled and are running a version prior to 5.0.2; the broader account-linking takeover path additionally requires the application's account-linking feature to be enabled. The attacker must control a LINE account to initiate authorization and must induce the victim to visit the crafted OAuth callback URL (UI:R), so the attack hinges on successful social engineering / phishing of the victim rather than a direct server-side trigger. Limiting factors: no effect on apps without the LINE backend, required victim interaction, and integrity-only impact (no data disclosure or availability loss); non-LINE social backends in the same library are not implicated by this specific flaw.

This is a genuine but conditional, medium-severity issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, 6.5) is internally consistent with the description: exploitation is network-reachable and low-complexity, needs no attacker authentication to the target, but DOES require victim interaction (UI:R) - the victim must be lured to the OAuth callback URL. The impact is integrity-only (I:H, with C:N/A:N), which fits a login-CSRF / account-linking flaw (CWE-352) where the attacker does not read victim data or crash the service but subverts authentication state. No EPSS score, KEV entry, or SSVC decision data was supplied, so automatability and exploitation-maturity cannot be scored from the input. There is no public exploit identified at time of analysis - the referenced GitHub PR #1829 and commit 5b3b90d are the FIX (adding a self.validate_state() call) plus regression tests, not weaponized attacker code. The practical priority is tempered by two real gating factors: only deployments that enable the LINE backend are affected, and the account-takeover-via-linking path additionally requires the application to have account linking enabled. Treat as a prioritized patch for any app using the social-core LINE backend, especially where account linking is on, but not a drop-everything event for the broader ecosystem.

An attacker begins a legitimate OAuth authorization flow for a LINE account they control, capturing the resulting callback URL, then phishes or otherwise induces a logged-in or anonymous victim to open that callback link. Because the LINE backend never validates the returned OAuth state parameter, the application completes the exchange and silently logs the victim into the attacker's LINE-backed account - or, if account linking is enabled, binds the attacker's LINE identity to the victim's existing account, creating a persistent backdoor login. No public exploit code is identified; the attack requires victim interaction (clicking the crafted callback).