CVE-2026-57177

Awaiting Analysis Awaiting Analysis - Queue

Login CSRF in Python Social Auth LoginRadius Backend

Publication date: 2026-09-24

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victim authenticated as the attacker's LoginRadius identity. The issue affects only applications using the LoginRadius backend. The issue has been fixe in version 5.0.0 by enabling callback state validation for the LoginRadius backend.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-05

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-57177

EUVD

EUVD-2026-86311

Affected Vendors & Products

Vendor	Product	Version / Range
python_social_auth	python_social_auth	5.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

Python Social Auth versions before 5.0.0 had a vulnerability in the LoginRadius backend where OAuth state was not validated during authentication. This allowed attackers to perform login CSRF attacks by tricking victims into authenticating with an attacker-controlled token.

Detection Guidance

Detection involves checking if your application uses the LoginRadius backend in python-social-auth versions prior to 5.0.0. Inspect configuration files for LoginRadius backend usage and verify OAuth state validation is enabled. No specific commands are provided in the context.

Impact Analysis

If you use an affected application with the LoginRadius backend, an attacker could hijack your session and authenticate as their LoginRadius identity. This could lead to unauthorized access to your account or actions performed on your behalf.

Compliance Impact

This vulnerability primarily impacts data integrity by allowing unauthorized authentication as another user, which could lead to unauthorized access to sensitive data. For GDPR, this may violate principles of lawful processing and data integrity. For HIPAA, it could compromise protected health information if exploited in healthcare applications.

Mitigation Strategies

Upgrade Python Social Auth to version 5.0.0 or later to enable callback state validation for the LoginRadius backend and prevent login CSRF attacks.

Hi! I’m here to help you understand CVE-2026-57177. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70