CVE-2026-115910
Received Received - Intake

OpenID Connect Nonce Validation Bypass in Python Social Auth

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: GitHub, Inc.

Description
Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in social_core/backends/open_id_connect.py uses get_and_store_nonce to place the OpenID Connect nonce in a shared OpenIdConnectAssociation table, and get_nonce and validate_claims verify only that the nonce exists and has not expired rather than binding it to the browser session and OAuth state that initiated the login. An attacker who obtains a victim's unused authorization code can start a separate login to obtain valid state for the attacker's browser, submit the victim's code with that state, and pass nonce validation because the victim nonce is globally available. With DEFAULT_USE_PKCE disabled in the default OpenIdConnectAuth configuration, the attacker can be logged in as the victim. This issue is fixed in version 6.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-115910
EUVD
EUVD-2026-109993

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
python-social-auth social-core < 6.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-384 Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Python Social Auth (prior to version 6.2.0) involves OpenID Connect (OIDC) authentication. The issue is that nonces (one-time tokens) used for security are stored in a shared table instead of being bound to the user's browser session. This allows an attacker to use a victim's unused authorization code in their own login session, bypassing authentication checks. The nonce validation only confirms existence and expiration, not session binding, enabling unauthorized account access.

Impact Analysis

If you use an application relying on Python Social Auth with OpenID Connect and DEFAULT_USE_PKCE disabled, an attacker could steal your authorization code and log in as you. This could lead to unauthorized access to your account, data theft, or impersonation. The impact depends on the application's sensitivity, but confidentiality and integrity are compromised.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR (data protection) and HIPAA (health data security) by enabling unauthorized access to sensitive user data. It undermines authentication integrity, a key control for regulatory compliance. Organizations using affected versions may face audit failures or legal liabilities if user data is compromised.

Mitigation Strategies

Upgrade python-social-auth/social-core to version 6.2.0 or later to apply the security patch that binds nonces to browser sessions and restricts nonce reuse across sessions.

Enable PKCE by default in your OpenID Connect configuration if it is not already enabled, as this mitigates the vulnerability even without session-bound nonces.

Restart any in-progress OIDC login sessions after upgrading to ensure the new security measures are active.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115910. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart