CVE-2026-62322

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-62322
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62322.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-62322
Aliases
Downstream
Published
2026-10-15T18:45:06Z
Modified
2026-10-16T10:46:27Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)
Details

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resulting callback URL, causing the application to log the victim into the attacker's account. When account linking is enabled, the same missing validation can link the attacker's LINE identity to the victim's existing account and create a persistent unauthorized login path. Only applications with the LINE backend enabled are affected. This issue is fixed in version 5.0.2.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-352"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62322.json"
}
References

Affected packages

Git / github.com/python-social-auth/social-core

Affected ranges

Type
GIT
Repo
https://github.com/python-social-auth/social-core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4101a750d5a0ff89d45ff8a42288691fb4e83b09
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "5.0.2"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*
0.0.1
0.1.0
0.2.0
0.2.1
1.*
1.0.1
1.1.0
1.2.0
1.3.0
1.4.0
1.5.0
1.6.0
1.7.0
2.*
2.0.0
3.*
3.0.0
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.3.3
3.4.0
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.1.0
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.9.0
4.9.1
5.*
5.0.0
5.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62322.json"