CVE-2026-57178: social-auth-core VK App Backend Accepts Unsigned Vulnerability

Q: What is CVE-2026-57178?

CVE-2026-57178 is a security vulnerability in social-auth-core involving VK App backend accepts unsigned callback data when auth_key is missing under CWE-287: Improper Authentication.

Q: Which social-auth-core versions are affected?

Affected versions include releases prior to 5.0.0 across affected packages: social-auth-core.

Q: What version fixes CVE-2026-57178?

Upgrading to 5.0.0 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is social-auth-core affected?

Yes, social-auth-core is affected in releases prior to 5.0.0. Upgrade your dependency to 5.0.0 or later.

Q: What is the CVSS score of CVE-2026-57178?

CVE-2026-57178 has a CVSS v3.1 base score of 7.4 (HIGH) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.

Q: What CWE is associated with CVE-2026-57178?

CVE-2026-57178 is classified under CWE-287: Improper Authentication (When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.).

Q: How can I check PyPI dependencies for CVE-2026-57178?

Run the dependency tree command: 'pip show social-auth-core'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

HIGH

Advisory Identifier: GHSA-3c93-f73f-qc9h

CVSS 7.4

CWE-287 CWE-347

Published 2026-09-24

Advisory Summary

CVE-2026-57178 is a HIGH (CVSS 7.4) vk app backend accepts unsigned vulnerability (CWE-287: Improper Authentication) affecting social-auth-core libraries in the PyPI ecosystem. The issue involves vk app backend accepts unsigned callback data when auth_key is missing. Remediation is available by upgrading affected packages to version 5.0.0.

CVE-2026-57178 at a Glance

CVE Identifier CVE-2026-57178

GHSA Identifier GHSA-3c93-f73f-qc9h

Severity HIGH

CVSS v3.1 Base Score 7.4

CWE Classification CWE-287: Improper Authentication

Affected Product social-auth-core

Package Ecosystem PyPI

Published Date 2026-09-24

Last Updated 2026-09-24

Security Impact

CVSS: 7.4

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

Attack Vector Network (AV:N)

Attack Complexity High (AC:H)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability None (A:N)

How to Fix CVE-2026-57178

To remediate this vulnerability, upgrade all affected social-auth-core dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

social-auth-core fixed: 5.0.0

pip install social-auth-core>=5.0.0

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

pip show social-auth-core

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2026-57178, inspect your installed packages using pip:

pip show social-auth-core

Analyze the terminal output to locate any version of social-auth-core in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 5.0.0), your application is affected.

Note: The pip show social-auth-core command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-287: Improper Authentication, where when an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. In social-auth-core, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact The `vk-app` backend accepted VK application callback data without verifying the callback signature when the `auth_key` parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as `viewer_id`, `access_token`, `api_id`, and `api_result`, potentially allowing authentication as an arbitrary VK user ID. The issue affects only applications using the `vk-app` backend. ### Patches The issue has been fixed by requiring `auth_key` to be present and valid before callback data is trusted. Users should upgrade to a patched version. Fix: * https://github.com/python-social-auth/social-core/pull/1811 ### Workarounds Applications that cannot upgrade immediately should disable the `vk-app` backend by removing `social_core.backends.vk.VKAppOAuth2` from `SOCIAL_AUTH_AUTHENTICATION_BACKENDS`. There is no complete workaround while continuing to use the vulnerable backend. ### Credits Reported by @lalalala5678 through GitHub private vulnerability reporting.

CVE-2026-57178 Affected social-auth-core Versions

1 component(s)

Fixed Versions:

5.0.0

Product / Package	Ecosystem	Affected Versions	Fixed Version
social-auth-core pypi/social-auth-core	PyPI	< 5.0.0	5.0.0

References

GitHub Advisory / Wiki ADVISORY

https://github.com/python-social-auth/social-core/security/advisories/GHSA-3c93-f73f-qc9h

NVD — CVE-2026-57178 NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-57178

social-auth-core Source Repository REPOSITORY

https://github.com/python-social-auth/social-core/pull/1811

Security Fix Commit FIX COMMIT

https://github.com/python-social-auth/social-core/commit/1bfacdd0379e5eb46e169a99ab648b835e9bb6a2

social-auth-core Source Repository REPOSITORY

https://github.com/python-social-auth/social-core

social-auth-core Release RELEASE

https://github.com/python-social-auth/social-core/releases/tag/5.0.0

Frequently Asked Questions

What is CVE-2026-57178?

CVE-2026-57178 is a security vulnerability in social-auth-core involving VK App backend accepts unsigned callback data when auth_key is missing under CWE-287: Improper Authentication.

Which social-auth-core versions are affected?

Affected versions include releases prior to 5.0.0 across affected packages: social-auth-core.

What version fixes CVE-2026-57178?

Upgrading to 5.0.0 (or the latest patched release for your respective branch) resolves the vulnerability.

Is social-auth-core affected?

Yes, social-auth-core is affected in releases prior to 5.0.0. Upgrade your dependency to 5.0.0 or later.

What is the CVSS score of CVE-2026-57178?

CVE-2026-57178 has a CVSS v3.1 base score of 7.4 (HIGH) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.

What CWE is associated with CVE-2026-57178?

CVE-2026-57178 is classified under CWE-287: Improper Authentication (When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.).

How can I check PyPI dependencies for CVE-2026-57178?

Run the dependency tree command: 'pip show social-auth-core'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3c93-f73f-qc9h",
  "modified" : "2026-09-24T19:57:22Z",
  "published" : "2026-09-24T19:57:22Z",
  "aliases" : [ "CVE-2026-57178" ],
  "summary" : "social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing",
  "details" : "### Impact\n\nThe `vk-app` backend accepted VK application callback data without verifying the callback signature when the `auth_key` parameter was omitted.\n\nApplications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as `viewer_id`, `access_token`, `api_id`, and `api_result`, potentially allowing authentication as an arbitrary VK user ID.\n\nThe issue affects only applications using the `vk-app` backend.\n\n### Patches\n\nThe issue has been fixed by requiring `auth_key` to be present and valid before callback data is trusted.\n\nUsers should upgrade to a patched version.\n\nFix:\n\n* https://github.com/python-social-auth/social-core/pull/1811\n\n### Workarounds\n\nApplications that cannot upgrade immediately should disable the `vk-app` backend by removing `social_core.backends.vk.VKAppOAuth2` from `SOCIAL_AUTH_AUTHENTICATION_BACKENDS`.\n\nThere is no complete workaround while continuing to use the vulnerable backend.\n\n### Credits\n\nReported by @lalalala5678 through GitHub private vulnerability reporting.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "social-auth-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "5.0.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/python-social-auth/social-core/security/advisories/GHSA-3c93-f73f-qc9h"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-57178"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python-social-auth/social-core/pull/1811"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python-social-auth/social-core/commit/1bfacdd0379e5eb46e169a99ab648b835e9bb6a2"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/python-social-auth/social-core"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python-social-auth/social-core/releases/tag/5.0.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-287", "CWE-347" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-24T19:57:22Z",
    "nvd_published_at" : "2026-09-24T18:17:14Z"
  }
}

CVSS V3

7.4 HIGH