python-social-auth social-core up to 4.x Partial Pipeline Resume Mechanism partial_token improper authentication

Summaryinfo

A vulnerability marked as critical has been reported in python-social-auth social-core up to 4.x. The affected element is an unknown function of the component Partial Pipeline Resume Mechanism. The manipulation of the argument partial_token leads to improper authentication. This vulnerability is traded as CVE-2026-57179. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in python-social-auth social-core up to 4.x. It has been rated as critical. This issue affects an unknown code of the component Partial Pipeline Resume Mechanism. The manipulation of the argument partial_token with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted `partial_token` as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow, obtain a valid partial token and verification data, and cause a victim's browser to resume that attacker-controlled flow. This could authenticate the victim's browser as the attacker's account. The issue affects applications using partial pipeline steps such as `mail_validation` or custom steps decorated with `@partial`. The issue has been fixed in version 5.0.0 by binding partial pipeline resumes to the originating browser session.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-57179 since 06/24/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 5.0.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• python-social-auth

Name

• social-core

Version

• 4.x

Website

• Product: https://github.com/python-social-auth/social-core/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion