python-social-auth social-core

• CVE-2026-115910 Medium 6.8 Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim 0.2%
• CVE-2026-62322 Medium 6.5 Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign) 0.2%
• CVE-2026-57179 Medium 4.2 social-auth-core has a Session Fixation issue 0.2%
• CVE-2026-57178 High 7.4 social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing 0.2%
• CVE-2026-57177 Medium 4.3 social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend 0.1%
• CVE-2026-57176 Medium 6.8 social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend 0.2%
• CVE-2026-57175 Medium 6.4 social-auth-core has an Improper Authentication issue 0.2%