{"id":"CVE-2026-57177","aliases":["GHSA-x7qq-23vw-7pfg","PYSEC-2026-4169"],"url":"https://o3.security/vulnerability/CVE-2026-57177","summary":"social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend","details":"### Impact\n\nThe LoginRadius backend did not validate OAuth state during the authentication flow.\n\nApplications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victim authenticated as the attacker's LoginRadius identity.\n\nThe issue affects only applications using the LoginRadius backend.\n\n### Patches\n\nThe issue has been fixed by enabling callback state validation for the LoginRadius backend.\n\nUsers should upgrade to a patched version.\n\nFix:\n\n* https://github.com/python-social-auth/social-core/pull/1808\n\n### Workarounds\n\nApplications that cannot upgrade immediately should disable the LoginRadius backend by removing it from `SOCIAL_AUTH_AUTHENTICATION_BACKENDS`.\n\nThere is no complete workaround while continuing to use the vulnerable backend.\n\n### Credits\n\nReported through GitHub private vulnerability reporting by Liyi Zhou, Ziyue Wang, Strick, Maurice, and Chenchen Yu from the University of Sydney security research team.\n\nReporter references:\n\n* https://lzhou1110.github.io/\n* https://zyy0530.github.io/\n* https://str1ckl4nd.github.io/\n* https://maurice.busystar.org/\n* https://7thparkk.github.io/","published":"2026-09-24T17:24:11.391Z","modified":"2026-10-21T02:58:44.719634400Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"social-auth-core","fixedVersion":"5.0.0"}],"fix":{"url":"https://github.com/python-social-auth/social-core/pull/1808","label":"python-social-auth/social-core#1808"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57177.json"},{"type":"ADVISORY","url":"https://github.com/python-social-auth/social-core/security/advisories/GHSA-x7qq-23vw-7pfg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57177"},{"type":"WEB","url":"https://github.com/python-social-auth/social-core/pull/1808"},{"type":"WEB","url":"https://github.com/python-social-auth/social-core/commit/4d332820e6b0583fde522956105a0e2beced5335"},{"type":"PACKAGE","url":"https://github.com/python-social-auth/social-core"},{"type":"WEB","url":"https://github.com/python-social-auth/social-core/releases/tag/5.0.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:44.719634400Z"}}