DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-57176: CVE-2026-57176: Multi-Tenant Account Takeover via Identity Binding Collision in python-social-auth Vend Backend

#security #cve #cybersecurity

CVE-2026-57176: Multi-Tenant Account Takeover via Identity Binding Collision in python-social-auth Vend Backend

Vulnerability ID: CVE-2026-57176
CVSS Score: 6.8
Published: 2026-09-24

An identity binding collision vulnerability in the Vend OAuth2 backend of python-social-auth (social-core) before version 5.0.0 allows unauthenticated remote attackers to take over local accounts in multi-tenant configurations. The flaw stems from relying on shop-local numeric user IDs as global social-auth identifiers, leading to collisions when identical IDs exist across distinct tenants.

TL;DR

Multi-tenant integrations of python-social-auth using the Vend OAuth2 backend are vulnerable to complete account takeover because the library incorrectly relies on non-unique, shop-local numeric user IDs for database mappings.

Technical Details

  • CWE ID: CWE-289
  • Attack Vector: Network
  • CVSS v3.1: 6.8
  • Exploit Status: No active public exploits
  • KEV Status: Not Listed
  • Impact: High Confidentiality, High Integrity (Account Takeover)

Affected Systems

  • Web applications integrating python-social-auth (social-core) with Vend OAuth2 backend
  • social-core: < 5.0.0 (Fixed in: 5.0.0)

Code Analysis

Commit: dee7ad1

Scope Vend OAuth UIDs by shop

Mitigation Strategies

  • Upgrade the python-social-auth (social-core) dependency to version 5.0.0 or higher.
  • Convert the database column type for social-auth UIDs from integer to string to ensure support for composite, scoped keys.
  • Implement application-level domain-prefix whitelisting to disable multi-tenant routing if only a single tenant is trusted.

Remediation Steps:

  1. Modify the application requirements file to specify social-auth-core>=5.0.0.
  2. Run database migrations for the social-auth mapping table (e.g., social_auth_usersocialauth) to change the 'uid' field to a string/varchar format.
  3. Verify that the legacy data migration executes properly during the first login of existing active users.
  4. Ensure any reverse-proxy or web application firewall (WAF) filters sanitize input for the 'domain_prefix' parameter.

References

Read the full report for CVE-2026-57176 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)