FKIE_CVE-2025-61783

Vulnerability from fkie_nvd - Published: 2025-10-09 21:15 - Updated: 2026-10-08 13:10
Severity
6.3 (Medium) - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Summary
Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses. Version 5.6.0 contains a patch. As a workaround, review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.
References
security-advisories@github.comhttps://github.com/python-social-auth/social-app-django/commit/10c80e2ebabeccd4e9c84ad0e16e1db74148ed4c
security-advisories@github.comhttps://github.com/python-social-auth/social-app-django/issues/220
security-advisories@github.comhttps://github.com/python-social-auth/social-app-django/issues/231
security-advisories@github.comhttps://github.com/python-social-auth/social-app-django/issues/634
security-advisories@github.comhttps://github.com/python-social-auth/social-app-django/pull/803
security-advisories@github.comhttps://github.com/python-social-auth/social-app-django/security/advisories/GHSA-wv4w-6qv2-qqfg
134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/python-social-auth/social-app-django/issues/220
134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/python-social-auth/social-app-django/issues/231
134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/python-social-auth/social-app-django/issues/634
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "social-app-django",
          "vendor": "python-social-auth",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.6.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn\u0027t require unique e-mail addresses. Version 5.6.0 contains a patch. As a workaround, review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability."
    },
    {
      "lang": "es",
      "value": "Python Social Auth es un mecanismo de autenticaci\u00f3n/registro social. En versiones anteriores a la 5.6.0, tras la autenticaci\u00f3n, el usuario pod\u00eda ser asociado por correo electr\u00f3nico incluso si el pipeline \u0027associate_by_email\u0027 no estaba incluido. Esto podr\u00eda llevar al compromiso de la cuenta cuando un servicio de autenticaci\u00f3n de terceros no valida las direcciones de correo electr\u00f3nico proporcionadas o no requiere direcciones de correo electr\u00f3nico \u00fanicas. La versi\u00f3n 5.6.0 contiene un parche. Como soluci\u00f3n alternativa, revise la pol\u00edtica del servicio de autenticaci\u00f3n sobre las direcciones de correo electr\u00f3nico; muchos no permitir\u00e1n explotar esta vulnerabilidad."
    }
  ],
  "id": "CVE-2025-61783",
  "lastModified": "2026-10-08T13:10:00.200",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-61783",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-10-15T19:49:15.864104Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-10-09T21:15:40.127",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/python-social-auth/social-app-django/commit/10c80e2ebabeccd4e9c84ad0e16e1db74148ed4c"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/python-social-auth/social-app-django/issues/220"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/python-social-auth/social-app-django/issues/231"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/python-social-auth/social-app-django/issues/634"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/python-social-auth/social-app-django/pull/803"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-wv4w-6qv2-qqfg"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/python-social-auth/social-app-django/issues/220"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/python-social-auth/social-app-django/issues/231"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/python-social-auth/social-app-django/issues/634"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-303"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.