CVE-2026-57177: CVE-2026-57177: Login Cross-Site Request Forgery in python-social-auth (social-auth-core)

#security #cve #cybersecurity

CVE-2026-57177: Login Cross-Site Request Forgery in python-social-auth (social-auth-core)

Vulnerability ID: CVE-2026-57177
CVSS Score: 4.3
Published: 2026-09-24

A Login Cross-Site Request Forgery (Login CSRF) vulnerability was discovered in the social-auth-core library prior to version 5.0.0 when utilizing the LoginRadius authentication backend. The backend explicitly disabled state token validation during the authentication callback, allowing attackers to link their identities to victim sessions.

TL;DR

Unvalidated OAuth state in the LoginRadius backend of social-auth-core allows unauthenticated attackers to hijack victim sessions via Login CSRF.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-352
Attack Vector: Network
CVSS Score: 4.3 (Medium)
EPSS Score: N/A (Not actively indexed)
Impact: Integrity Loss (Identity mapping manipulation)
Exploit Status: Proof of Concept
KEV Status: Not Listed

Affected Systems

python-social-auth
social-auth-core
social-auth-core: < 5.0.0 (Fixed in: 5.0.0)

Code Analysis

Commit: 4d33282

Fix LoginRadius state handling to mitigate CSRF security vulnerability

--- a/social_core/backends/loginradius.py
+++ b/social_core/backends/loginradius.py
@@ -22,7 +22,7 @@ class LoginRadiusAuth(BaseOAuth2):
     ID_KEY = "ID"
     ACCESS_TOKEN_URL = "https://api.loginradius.com/api/v2/access_token"
     PROFILE_URL = "https://api.loginradius.com/api/v2/userprofile"
-    REDIRECT_STATE = False
+    REDIRECT_STATE = True
     STATE_PARAMETER = False

     def uses_redirect(self) -> bool:
@@ -31,13 +31,15 @@ def uses_redirect(self) -> bool:

     def auth_html(self):
         key, _secret = self.get_key_and_secret()
+        state = self.get_or_create_state()
         tpl = self.setting("TEMPLATE", "loginradius.html")
         return self.strategy.render_html(
             tpl=tpl,
             context={
                 "backend": self,
                 "LOGINRADIUS_KEY": key,
-                "LOGINRADIUS_REDIRECT_URL": self.get_redirect_uri(),
+                "LOGINRADIUS_REDIRECT_STATE": state,
+                "LOGINRADIUS_REDIRECT_URL": self.get_redirect_uri(state),
             },
         )

Exploit Details

GitHub: Integrated programmatic unit tests demonstrating the bypass of the state parameter in affected versions and validation of correct state verification in patched environments.

Mitigation Strategies

Upgrade social-auth-core to version 5.0.0 or higher.
Disable the LoginRadius backend in the application settings if immediate patching is not possible.
Enforce SameSite=Lax cookie attribute to restrict cross-site credential transmission.

Remediation Steps:

Run 'pip install --upgrade social-auth-core>=5.0.0' to update the library.
Inspect configuration settings (e.g. Django settings.py) and remove 'social_core.backends.loginradius.LoginRadiusAuth' if patching is delayed.
Restart the application services to apply the updated code or configuration.

References

Read the full report for CVE-2026-57177 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community