CVE-2026-57176

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-57176
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57176.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-57176
Aliases
Downstream
Published
2026-09-24T17:22:54Z
Modified
2026-09-25T03:48:33Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend
Details

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop. The issue affects applications using the Vend OAuth2 backend with more than one Vend shop. Version 5.0.0 patches the issue.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-289"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57176.json"
}
References

Affected packages

Git / github.com/python-social-auth/social-core

Affected ranges

Type
GIT
Repo
https://github.com/python-social-auth/social-core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
29dffe68c7c23f3d5cb5e051e7cb40447ffb55d5
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "5.0.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*
0.0.1
0.1.0
0.2.0
0.2.1
1.*
1.0.1
1.1.0
1.2.0
1.3.0
1.4.0
1.5.0
1.6.0
1.7.0
2.*
2.0.0
3.*
3.0.0
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.3.3
3.4.0
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.1.0
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.9.0
4.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57176.json"