CVE-2026-57175: Improper Authentication in social-auth-core SAML Backend
Vulnerability ID: CVE-2026-57175
CVSS Score: 6.4
Published: 2026-09-24
An improper authentication vulnerability (CWE-287) exists in the SAML backend of the social-auth-core package before version 5.0.0. The Assertion Consumer Service (ACS) endpoint does not verify whether incoming SAML assertions match a previously initiated AuthnRequest in the user's session. This permits an attacker with credentials on a shared Identity Provider to perform a 'Session Donor' attack, permanently linking their SAML identity to an authenticated victim's account and achieving full, persistent account takeover.
TL;DR
The social-auth-core SAML backend failed to validate the InResponseTo attribute in SAML responses against the local session. This allows attackers to link their own external SAML identity to a victim's active session, gaining complete and permanent access to the victim's account.
Technical Details
- CWE ID: CWE-287
- Attack Vector: AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
- CVSS Score: 6.4 (Medium)
- EPSS Score: Not Available
- Impact: Account Takeover / Unauthorized Identity Mapping
- Exploit Status: No public exploit available
- KEV Status: Not listed
Affected Systems
- social-auth-core (PyPI package)
-
social-auth-core: < 5.0.0 (Fixed in:
5.0.0)
Code Analysis
Commit: 5c72f71
Add verification of InResponseTo attribute in SAML responses
Mitigation Strategies
- Upgrade social-auth-core to version 5.0.0 or higher
- Disable SAML account association flows
- Remove SAML from authentication backends
Remediation Steps:
- Identify current social-auth-core installation version
- Execute 'pip install --upgrade social-auth-core>=5.0.0'
- Verify session-based transaction state configuration
- Audit existing SAML account associations for duplicate mappings
References
Read the full report for CVE-2026-57175 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)