Vulnerability · Published Oct 9, 2025 · Assigned by GitHub_M
CVE-2025-61783Python Social Auth - Django has unsafe account association
Medium 6.3
In plain English
A medium-severity security flaw in social-app-django from python-social-auth. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses. Version 5.6.0 contains a patch. As a workaround, review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | social-auth-app-django | no fix listed | DEBIAN-CVE-2025-61783 |
| Debian:13 | social-auth-app-django | no fix listed | DEBIAN-CVE-2025-61783 |
| Debian:14 | social-auth-app-django | no fix listed | DEBIAN-CVE-2025-61783 |
| PyPI | social-auth-app-django | 5.6.0 | GHSA-wv4w-6qv2-qqfg |
| PyPI | social-auth-app-django | 5.6.0 | PYSEC-2026-1932 |
| Ubuntu:22.04:LTS | social-auth-app-django | no fix listed | UBUNTU-CVE-2025-61783 |
| Ubuntu:24.04:LTS | social-auth-app-django | no fix listed | UBUNTU-CVE-2025-61783 |
| Ubuntu:25.10 | social-auth-app-django | no fix listed | UBUNTU-CVE-2025-61783 |
| Ubuntu:26.04:LTS | social-auth-app-django | no fix listed | UBUNTU-CVE-2025-61783 |
| Ubuntu:26.10 | social-auth-app-django | no fix listed | UBUNTU-CVE-2025-61783 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| python-social-auth | social-app-django | < 5.6.0 |
Weakness: CWE-303 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
References
- https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-wv4w-6qv2-qqfg x_refsource_CONFIRM
- https://github.com/python-social-auth/social-app-django/issues/220 x_refsource_MISC
- https://github.com/python-social-auth/social-app-django/issues/231 x_refsource_MISC
- https://github.com/python-social-auth/social-app-django/issues/634 x_refsource_MISC
- https://github.com/python-social-auth/social-app-django/pull/803 x_refsource_MISC
- https://github.com/python-social-auth/social-app-django/commit/10c80e2ebabeccd4e9c84ad0e16e1db74148ed4c x_refsource_MISC