CVE-2026-57178: CVE-2026-57178: Authentication Bypass via Missing Signature Verification in social-auth-core

#security #cve #cybersecurity

CVE-2026-57178: Authentication Bypass via Missing Signature Verification in social-auth-core

Vulnerability ID: CVE-2026-57178
CVSS Score: 7.4
Published: 2026-09-24

An authentication bypass vulnerability exists in the VKontakte App backend of social-auth-core prior to version 5.0.0. The vulnerability allows remote attackers to bypass cryptographic signature verification and gain unauthorized access to arbitrary accounts by omitting the signature parameter.

TL;DR

Applications using the vk-app authentication backend in social-auth-core < 5.0.0 fail to verify signatures if the auth_key parameter is completely omitted, allowing full account bypass via spoofed VKontakte user IDs.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-287 / CWE-347
Attack Vector: Network
CVSS Severity: 7.4 (High)
Impact: Unauthenticated Account Takeover
Exploit Status: PoC / Conceptual
KEV Status: Not listed

Affected Systems

Python Social Auth libraries running social-auth-core < 5.0.0
Django applications using social-auth-app-django with VKAppOAuth2 backend enabled
Flask and Webpy integrations configured to use VKAppOAuth2
social-auth-core: < 5.0.0 (Fixed in: 5.0.0)

Code Analysis

Commit: 1bfacdd

Fix VK application authentication signature bypass vulnerability by enforcing the presence of the auth_key parameter and raising AuthFailed.

@@ -184,12 +184,13 @@ def auth_complete(self, *args, **kwargs):

         auth_key = self.data.get("auth_key")

-        # Verify signature, if present
+        # Verify signature before trusting callback data.
         key, secret = self.get_key_and_secret()
-        if auth_key:
-            check_key = vk_sig(f"{key}_{self.data.get('viewer_id')}_{secret}")
-            if check_key != auth_key:
-                raise ValueError("VK.com authentication failed: invalid auth key")
+        if not auth_key:
+            raise AuthFailed(self, "Missing auth key")
+        check_key = vk_sig(f"{key}_{self.data.get('viewer_id')}_{secret}")
+        if check_key != auth_key:
+            raise AuthFailed(self, "Invalid auth key")

Mitigation Strategies

Upgrade the social-auth-core library to version 5.0.0 or later.
Disable the vulnerable VKAppOAuth2 backend from configuration settings if upgrades are blocked.
Fallback to the standard VKOAuth2 backend for VKontakte integrations.

Remediation Steps:

Open your dependency specification files (e.g., requirements.txt, Pipfile, poetry.lock).
Modify the social-auth-core entry to point to version >= 5.0.0.
Execute your package manager upgrade command (e.g., pip install --upgrade social-auth-core>=5.0.0).
Inspect configuration settings for references to social_core.backends.vk.VKAppOAuth2 and verify its removal if on an older version.

References

Read the full report for CVE-2026-57178 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community