https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 09:15:19 +0000 https://vulnerability.circl.lu/vuln/cve-2026-57179 <p><strong>Affected:</strong> python-social-auth social-core</p> <p>Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted `partial_token` as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow, obtain a valid partial token and verification data, and cause a victim&#39;s browser to resume that attacker-controlled flow. This could authenticate the victim&#39;s browser as the attacker&#39;s account. The issue affects applications using partial pipeline steps such as `mail_validation` or custom steps decorated with `@partial`. The issue has been fixed in version 5.0.0 by binding partial pipeline resumes to the originating browser session.</p> <p><strong>Affected:</strong> python-social-auth social-core</p> <p>Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted `partial_token` as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow, obtain a valid partial token and verification data, and cause a victim&#39;s browser to resume that attacker-controlled flow. This could authenticate the victim&#39;s browser as the attacker&#39;s account. The issue affects applications using partial pipeline steps such as `mail_validation` or custom steps decorated with `@partial`. The issue has been fixed in version 5.0.0 by binding partial pipeline resumes to the originating browser session.</p> https://vulnerability.circl.lu/vuln/cve-2026-57179 https://vulnerability.circl.lu/vuln/ghsa-vqg6-3fw6-j9jg <p><strong>Affected:</strong> PyPI: social-auth-core</p> <p>### Impact</p> <p>The partial-pipeline resume mechanism accepted `partial_token` as a bearer credential without binding it to the browser session that created it.</p> <p>Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow, obtain a valid partial token and verification data, and cause a victim&#39;s browser to resume that attacker-controlled flow. This could authenticate the victim&#39;s browser as the attacker&#39;s account.</p> <p>The issue affects applications using partial pipeline steps such as `mail_validation` or custom steps decorated with `@partial`.</p> <p>### Patches</p> <p>The issue has been fixed by binding partial pipeline resumes to the originating browser session.</p> <p>Users should upgrade to a patched version.</p> <p>Fix:</p> <p>* https://github.com/python-social-auth/social-core/pull/1816 * https://github.com/python-social-auth/social-docs/pull/444 * https://github.com/python-social-auth/social-app-django/pull/1009</p> <p>### Workarounds</p> <p>Applications that cannot upgrade immediately should disable resumable partial pipeline steps, including `mail_validation` and custom steps decorated with `@partial`.</p> <p>If those flows are required, applications should avoid accepting partial resume links from untrusted contexts until a patched version can be deployed.</p> <p>There is no complete workaround while continuing to use the vulnerable partial-pipeline resume mechanism.</p> <p>### Credits</p> <p>Reported through GitHub private vulnerability reporting by Liyi Zhou, Ziyue Wang, Strick, Maurice,…</p> <p><strong>Affected:</strong> PyPI: social-auth-core</p> <p>### Impact</p> <p>The partial-pipeline resume mechanism accepted `partial_token` as a bearer credential without binding it to the browser session that created it.</p> <p>Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow, obtain a valid partial token and verification data, and cause a victim&#39;s browser to resume that attacker-controlled flow. This could authenticate the victim&#39;s browser as the attacker&#39;s account.</p> <p>The issue affects applications using partial pipeline steps such as `mail_validation` or custom steps decorated with `@partial`.</p> <p>### Patches</p> <p>The issue has been fixed by binding partial pipeline resumes to the originating browser session.</p> <p>Users should upgrade to a patched version.</p> <p>Fix:</p> <p>* https://github.com/python-social-auth/social-core/pull/1816 * https://github.com/python-social-auth/social-docs/pull/444 * https://github.com/python-social-auth/social-app-django/pull/1009</p> <p>### Workarounds</p> <p>Applications that cannot upgrade immediately should disable resumable partial pipeline steps, including `mail_validation` and custom steps decorated with `@partial`.</p> <p>If those flows are required, applications should avoid accepting partial resume links from untrusted contexts until a patched version can be deployed.</p> <p>There is no complete workaround while continuing to use the vulnerable partial-pipeline resume mechanism.</p> <p>### Credits</p> <p>Reported through GitHub private vulnerability reporting by Liyi Zhou, Ziyue Wang, Strick, Maurice,…</p> https://vulnerability.circl.lu/vuln/ghsa-vqg6-3fw6-j9jg