UBUNTU-CVE-2026-62322

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-62322
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-62322.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-62322
Upstream
Published
2026-10-16T00:00:00Z
Modified
2026-10-17T13:00:30Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resulting callback URL, causing the application to log the victim into the attacker's account. When account linking is enabled, the same missing validation can link the attacker's LINE identity to the victim's existing account and create a persistent unauthorized login path. Only applications with the LINE backend enabled are affected. This issue is fixed in version 5.0.2.

References

Affected packages

Ubuntu:20.04:LTS / social-auth-core

Package

Name
social-auth-core
Purl
pkg:deb/ubuntu/social-auth-core?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.1.0-1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "python3-social-auth-core",
            "binary_version":  "3.1.0-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-62322.json"

Ubuntu:22.04:LTS / social-auth-core

Package

Name
social-auth-core
Purl
pkg:deb/ubuntu/social-auth-core?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.1.0-1.1
4.*
4.1.0-1
4.2.0-1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "python3-social-auth-core",
            "binary_version":  "4.2.0-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-62322.json"

Ubuntu:24.04:LTS / social-auth-core

Package

Name
social-auth-core
Purl
pkg:deb/ubuntu/social-auth-core?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

4.*
4.4.2-2
4.5.3-1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "python3-social-auth-core",
            "binary_version":  "4.5.3-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-62322.json"

Ubuntu:26.04:LTS / social-auth-core

Package

Name
social-auth-core
Purl
pkg:deb/ubuntu/social-auth-core?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

4.*
4.6.1-1
4.8.1-1
4.8.3-1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "python3-social-auth-core",
            "binary_version":  "4.8.3-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-62322.json"