CVE-2026-115910 in python-social-auth
Summary
by MITRE • 10/26/2026
Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in social_core/backends/open_id_connect.py uses get_and_store_nonce to place the OpenID Connect nonce in a shared OpenIdConnectAssociation table, and get_nonce and validate_claims verify only that the nonce exists and has not expired rather than binding it to the browser session and OAuth state that initiated the login. An attacker who obtains a victim's unused authorization code can start a separate login to obtain valid state for the attacker's browser, submit the victim's code with that state, and pass nonce validation because the victim nonce is globally available. With DEFAULT_USE_PKCE disabled in the default OpenIdConnectAuth configuration, the attacker can be logged in as the victim. This issue is fixed in version 6.2.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/26/2026
Python Social Auth prior to version 6.2.0 contains a critical authentication bypass vulnerability within its OpenID Connect implementation that allows attackers to hijack user sessions through authorization code interception and state manipulation. The core technical flaw resides in the handling of nonces during the OAuth flow, specifically within the open_id_connect.py module where functions such as get_and_store_nonce, get_nonce, and validate_claims operate. In vulnerable versions, these functions store OpenID Connect nonces in a shared global database table rather than binding them to specific browser sessions or unique OAuth state parameters initiated by the login request. This architectural oversight means that nonce validation relies solely on checking for existence and expiration time, ignoring the critical requirement of associating the nonce with the originating session context. Consequently, the security mechanism fails to enforce strict binding between the authentication token and the user's active session, creating a significant gap in identity verification protocols.
The operational impact of this vulnerability is severe, enabling remote attackers to perform account takeover attacks against users who utilize OpenID Connect for social login. An attacker can exploit this flaw by first obtaining an unused authorization code from a victim, potentially through phishing or network interception if PKCE is not enforced. The attacker then initiates their own legitimate login flow with the identity provider to obtain a valid state parameter and nonce associated with their own browser session. By submitting the stolen victim's authorization code alongside the newly acquired state and nonce parameters, the attacker successfully bypasses validation checks because the system only verifies that the nonce exists in the global store and has not expired, without confirming it matches the specific request context of the victim. With the default configuration where PKCE is disabled, this attack chain completes successfully, resulting in the attacker being logged into the application as the compromised user with full access to their account data and privileges.
This vulnerability aligns closely with CWE-287, which describes Improper Authentication, specifically regarding the failure to properly bind authentication credentials to a specific session or transaction context. It also relates to CWE-345, Insufficient Verification of Data Authenticity, as the system fails to verify that the nonce and state parameters correspond to the same logical flow initiated by the user. From an ATT&CK perspective, this flaw facilitates Initial Access via Valid Accounts through exploitation of authentication bypass techniques, allowing adversaries to leverage stolen credentials or tokens without needing to crack passwords or exploit additional software vulnerabilities. The lack of session-specific binding for nonces represents a fundamental misunderstanding of stateful security requirements in OAuth 2.0 and OpenID Connect flows, where nonce values must be unique per request and strictly tied to the client's current interaction with the identity provider.
Mitigation strategies focus primarily on upgrading the Python Social Auth library to version 6.2.0 or later, which corrects the nonce storage mechanism to ensure proper binding to browser sessions and OAuth state parameters. For environments where immediate patching is not feasible, administrators should enforce PKCE by setting DEFAULT_USE_PKCE to true in the configuration settings. Enabling PKCE adds a code verifier challenge that significantly mitigates authorization code interception attacks even if nonces are not perfectly bound, as it requires the client to prove possession of a secret generated during the initial request. Additionally, organizations should implement strict monitoring for unusual login patterns and ensure that identity providers support modern security standards such as state parameter validation and secure cookie attributes like HttpOnly and Secure flags to reduce the risk of session hijacking through other vectors. Regular audits of authentication configurations against industry best practices are recommended to prevent similar misconfigurations in social auth implementations.