CVE-2026-57178

Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass in Python Social Auth via VK App Backend

Publication date: 2026-09-24

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the `vk-app` backend accepted VK application callback data without verifying the callback signature when the `auth_key` parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as `viewer_id`, `access_token`, `api_id`, and `api_result`, potentially allowing authentication as an arbitrary VK user ID. The issue affects only applications using the `vk-app` backend. The issue has been fixed in version 5.0.0 by requiring `auth_key` to be present and valid before callback data is trusted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-28

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-13

NVD

CVE-2026-57178

EUVD

EUVD-2026-86312

Affected Vendors & Products

Vendor	Product	Version / Range
python_social_auth	python_social_auth	to 5.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability affects the VK App backend in the python-social-auth library. It allows the backend to accept unsigned callback data when the auth_key parameter is missing. Attackers can manipulate callback fields like viewer_id, access_token, api_id, and api_result to authenticate as an arbitrary VK user ID.

Detection Guidance

Check if your application uses the vk-app backend in python-social-auth. Inspect callback handling for unsigned VK data. Verify if auth_key validation is enforced. Review logs for suspicious authentication attempts with arbitrary viewer_id or access_token values.

Impact Analysis

An attacker could impersonate any VK user in applications using the vulnerable vk-app backend. This could lead to unauthorized access to user accounts, data breaches, or other malicious activities depending on the application's functionality.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face compliance penalties, reputational damage, and legal consequences if user data is compromised through this flaw.

Mitigation Strategies

Upgrade python-social-auth to version 5.0.0 or later. If upgrading is not possible, disable the vk-app backend immediately. Ensure all VK callbacks require valid auth_key validation before processing.

Hi! I’m here to help you understand CVE-2026-57178. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70