EUVD-2026-86312
GHSA-3c93-f73f-qc9h
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Omitting a parameter and supplying forged fields is low-complexity (AC:L); the vk-app-only scope is a deployment prerequisite, not attack complexity; arbitrary-user auth gives C:H/I:H, A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the auth_key parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as viewer_id, access_token, api_id, and api_result, potentially allowing authentication as an arbitrary VK user ID. The issue affects only applications using the vk-app backend. The issue has been fixed in version 5.0.0 by requiring auth_key to be present and valid before callback data is trusted.
Articles & Coverage 1
AnalysisAI
Authentication bypass in Python Social Auth (social-core) versions prior to 5.0.0 allows unauthenticated remote attackers to impersonate any VK user when an application uses the vk-app backend, as the backend skips signature verification if the auth_key parameter is omitted. An attacker can forge callback fields such as viewer_id, access_token, api_id, and api_result to authenticate as an arbitrary VK identity, potentially taking over accounts in the target application. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable ONLY when the target application is configured to use python-social-auth's `vk-app` (VKontakte application) backend on social-core prior to 5.0.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine authentication-bypass flaw (CWE-287) with real integrity/confidentiality impact: the CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N describes a remotely reachable, unauthenticated (PR:N) attack that yields C:H/I:H because success means authenticating as an arbitrary VK user (full account takeover in the target application). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to social-core version 5.0.0 or later, which enforces the presence and validity of the auth_key signature before trusting callback data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications and services that depend on Python Social Auth (social-core) and confirm which of them have the vk-app backend enabled; treat any match as exposed and begin remediation immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today