CVE-2026-62322

Awaiting Analysis Awaiting Analysis - Queue

Missing State Validation in Python Social Auth LINE Backend

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resulting callback URL, causing the application to log the victim into the attacker's account. When account linking is enabled, the same missing validation can link the attacker's LINE identity to the victim's existing account and create a persistent unauthorized login path. Only applications with the LINE backend enabled are affected. This issue is fixed in version 5.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-62322

EUVD

EUVD-2026-102323

Affected Vendors & Products

Vendor	Product	Version / Range
python-social-auth	social-core	< 5.0.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is a Login Cross-Site Request Forgery (CSRF) issue in the LINE backend of the python-social-auth/social-core library affecting versions prior to 5.0.2. The flaw occurs because the OAuth state is not properly validated during the authorization code exchange. An attacker can exploit this by initiating a LINE authorization flow with their own account and tricking a victim into visiting a malicious callback URL containing the attacker's authorization code. Since the OAuth state is not checked, the application may accept this forged callback, logging the victim in as the attacker's LINE account.

If account linking is enabled, the attacker could also link their LINE identity to the victim's existing account, creating a persistent unauthorized access path.

Detection Guidance

To detect this vulnerability, check if your python-social-auth/social-core library version is below 5.0.2. Run commands like pip show social-core or pip list to verify the installed version. Inspect application logs for unusual login attempts or account linking events involving LINE backend.

Impact Analysis

An attacker could gain unauthorized access to your account if you use an affected version of the library with the LINE backend enabled. This could lead to data exposure, account takeover, or actions performed under your identity without your consent. The attack requires user interaction, such as clicking a malicious link.

Compliance Impact

This vulnerability primarily enables unauthorized account access through CSRF attacks, which could lead to data breaches or unauthorized data exposure. For GDPR, this may violate principles of data protection and user consent. For HIPAA, it could compromise protected health information if linked to healthcare applications. The impact depends on the specific use case and data processed by the affected application.

Mitigation Strategies

Immediately update python-social-auth/social-core to version 5.0.2 or later. Disable the LINE backend if not required. Review and revoke any suspicious linked accounts. Monitor for unauthorized access or account linking activities.

Hi! I’m here to help you understand CVE-2026-62322. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70