CVE-2026-57179
Summary
by MITRE • 09/24/2026
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted `partial_token` as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow, obtain a valid partial token and verification data, and cause a victim's browser to resume that attacker-controlled flow. This could authenticate the victim's browser as the attacker's account. The issue affects applications using partial pipeline steps such as `mail_validation` or custom steps decorated with `@partial`. The issue has been fixed in version 5.0.0 by binding partial pipeline resumes to the originating browser session.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/24/2026
Python Social Auth is a widely utilized library for implementing social authentication and registration mechanisms within web applications, enabling users to log in via third-party identity providers such as Google, Facebook, or GitHub. Prior to version 5.0.0, the library contained a critical security flaw within its partial-pipeline resume mechanism that undermined the integrity of the authentication flow by failing to properly bind session context to temporary credentials. This vulnerability stems from an improper handling of state during multi-step authentication processes, where intermediate states are preserved using tokens rather than being tightly coupled with the user's active browser session identifiers such as cookies or HTTP-only sessions.
The technical flaw lies in how the partial_token was processed when resuming a pipeline step. In versions prior to 5.0.0, the system accepted the partial_token solely as a bearer credential without verifying that it originated from the same browser session that initiated the authentication request. This design oversight allowed for an attacker-controlled flow scenario where malicious actors could exploit this lack of binding. Specifically, an attacker could initiate an authentication flow with their own account on a target application utilizing Python Social Auth. During this process, the system would generate a valid partial_token and associated verification data necessary to complete specific pipeline steps, such as email validation or custom logic decorated with the @partial decorator.
Because the token was not bound to the originating session, an attacker could subsequently trick a victim into resuming that same authentication flow using their own browser. This is typically achieved through social engineering techniques or cross-site request forgery vectors where the victim's browser is directed to resume the pipeline step containing the attacker-controlled partial_token. When the victim's browser submits this token, the server validates it based on its content and expiration but fails to check if the current session matches the one that originally created the token. Consequently, the application authenticates the victim as the attacker, effectively hijacking the victim's identity within the context of the authentication flow.
The operational impact of this vulnerability is severe, particularly for applications relying on resumable partial pipeline steps like mail_validation or any custom step marked with @partial. These features are designed to allow users to pause and resume complex registration processes, but without proper session binding, they become a vector for account takeover. An attacker does not need to compromise the victim's credentials directly; instead, they manipulate the authentication state machine to force the system to associate the victim's active browser session with the attacker's identity provider data. This results in unauthorized access where the victim is logged into an account that belongs to someone else, potentially leading to privacy violations, data exfiltration, or further exploitation depending on the privileges associated with the attacker's account.
This vulnerability aligns with CWE-384, Session Fixation, as it involves allowing a user session identifier from one context (the attacker) to be accepted in another context (the victim), and also relates to CWE-270, Privilege Assignment to Wrong Entity, because the system incorrectly assigns the identity of the attacker to the victim's active session. From an ATT&CK perspective, this behavior facilitates Account Manipulation techniques where adversaries gain access by exploiting trust relationships or misconfigured authentication flows rather than through direct credential theft. The lack of strict binding between the temporary state token and the persistent browser session represents a fundamental failure in maintaining contextual integrity during multi-step web interactions.
The issue has been resolved in version 5.0.0 of Python Social Auth by implementing stricter validation logic that binds partial pipeline resumes to the originating browser session. This fix ensures that when a partial_token is presented for resumption, the system verifies that it corresponds to the current active session context established during the initial request initiation. Developers using versions prior to 5.0.0 are strongly advised to upgrade immediately to mitigate this risk. Additionally, organizations should ensure they follow secure coding practices by validating all state transitions in authentication flows and avoiding reliance on client-side or loosely bound tokens for critical security decisions. Regular auditing of third-party libraries used for identity management is essential to maintain the integrity of access control mechanisms within web applications.