CVE-2026-57176
Received Received - Intake

Vend OAuth2 UID Collision in Python Social Auth

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop. The issue affects applications using the Vend OAuth2 backend with more than one Vend shop. Version 5.0.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-57176
EUVD
EUVD-2026-86310

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
python_social_auth python_social_auth to 5.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-289 The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Python Social Auth before version 5.0.0 had a flaw in its Vend OAuth2 backend. It used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticated through the same app, users from different shops with the same internal Vend user ID could collide in the social-auth association table. This allowed a user from one shop to be authenticated as a local account from another shop with the same user ID.

Impact Analysis

This vulnerability could allow unauthorized access to user accounts. If two different shops have users with the same numeric ID, an attacker could log in as a different user, potentially gaining access to sensitive data or performing actions on behalf of another user.

Mitigation Strategies

Upgrade Python Social Auth to version 5.0.0 or later to address the UID collision issue in the Vend OAuth2 backend.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57176. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart