Executive Summary

CVE-2025-61783 is a vulnerability in the python-social-auth/social-app-django library where, prior to version 5.6.0, users could be associated by email during social authentication even if the 'associate_by_email' pipeline was not enabled. This means that if a third-party authentication service does not validate email addresses or enforce unique emails, an attacker could log in as an existing user simply by providing the same email address. The root cause is that the system automatically associates social authentication attempts with existing user accounts based on email, bypassing expected security controls and allowing unauthorized access. [1, 2, 4, 6]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to account compromise by allowing unauthorized users to log in as existing users without proper credentials, simply by using the same email address during social authentication. This can result in unauthorized access to user accounts, potentially exposing sensitive information or allowing malicious actions under another user's identity. The impact is moderate with a CVSS score of 6.3, and exploitation requires specific conditions such as a third-party authentication provider that does not validate emails properly. [2, 4, 6]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing whether social authentication allows login by email matching even when the 'associate_by_email' pipeline is disabled. One way to detect it is to create a normal user account with a specific email, then attempt to log in via a social authentication provider using the same email but different backend. If the login succeeds and links to the existing user account without proper validation, the system is vulnerable. Specific commands include using Django's createsuperuser command to create a user, then attempting social login with the same email. There are no explicit network or system commands provided in the resources, but reproducing the issue involves social authentication flows and checking user associations in the database. [4, 6]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading the python-social-auth/social-app-django package to version 5.6.0 or later, where the vulnerability is patched. If upgrading is not immediately possible, review and enforce strict email validation policies on the third-party authentication services to ensure emails are verified and unique, reducing the risk of exploitation. Additionally, be aware that the patch removes unsafe automatic user association on creation failure and requires manual restart of the authentication pipeline to enforce policies properly. [2, 3]

Useful 0 Not Useful 0