CVE-2026-62322 · GHSA-526j-582w-7fm9

Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

Risk score: 50/100
CVSS: 6.5 v3.1
Exploit chance (30 days): 0.2%
Published: 15 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resulting callback URL, causin…
Affected: social-auth-core (pip) < 5.0.2
Fix: Upgrade social-auth-core to 5.0.2 or later.
Exploitation: No known exploitation

Why it is Yellow

CVSS 6.5 medium
On your watchlist: python, PyPI

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
social-auth-core	pip	< 5.0.2	5.0.2

References

Original description

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resulting callback URL, causing the application to log the victim into the attacker's account. When account linking is enabled, the same missing validation can link the attacker's LINE identity to the victim's existing account and create a persistent unauthorized login path. Only applications with the LINE backend enabled are affected. This issue is fixed in version 5.0.2.

Last activity 15 Oct 2026. Patch Forecast updates every hour.