python-social-auth up to 6.1.x OpenIdConnectAuth open_id_connect.py get_and_store_nonce improper authorization

Summaryinfo

A vulnerability categorized as critical has been discovered in python-social-auth up to 6.1.x. Affected is the function get_and_store_nonce of the file social_core/backends/open_id_connect.py of the component OpenIdConnectAuth. The manipulation of the argument nonce results in improper authorization. This vulnerability is identified as CVE-2026-115910. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in python-social-auth up to 6.1.x. Affected is the function get_and_store_nonce of the file social_core/backends/open_id_connect.py of the component OpenIdConnectAuth. The manipulation of the argument nonce with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in social_core/backends/open_id_connect.py uses get_and_store_nonce to place the OpenID Connect nonce in a shared OpenIdConnectAssociation table, and get_nonce and validate_claims verify only that the nonce exists and has not expired rather than binding it to the browser session and OAuth state that initiated the login. An attacker who obtains a victim's unused authorization code can start a separate login to obtain valid state for the attacker's browser, submit the victim's code with that state, and pass nonce validation because the victim nonce is globally available. With DEFAULT_USE_PKCE disabled in the default OpenIdConnectAuth configuration, the attacker can be logged in as the victim. This issue is fixed in version 6.2.0.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-115910 since 10/23/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1548.002 by the MITRE ATT&CK project.

Upgrading to version 6.2.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Programming Language Software

Name

• python-social-auth

Version

• 6.0
• 6.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion