CVE-2026-57179: CVE-2026-57179: Session Fixation and Login CSRF in social-auth-core Partial Pipeline

CVE-2026-57179: Session Fixation and Login CSRF in social-auth-core Partial Pipeline

Vulnerability ID: CVE-2026-57179
CVSS Score: 4.2
Published: 2026-09-24

CVE-2026-57179 is a critical Session Fixation and Login Cross-Site Request Forgery (CSRF) vulnerability in python-social-auth's core library (social-auth-core) prior to version 5.0.0. The vulnerability allows remote attackers to force arbitrary state transitions and bind third-party social credentials to a victim's session, leading to complete account takeover.

TL;DR

Unauthenticated remote session fixation and login CSRF via unvalidated partial pipeline tokens in social-auth-core < 5.0.0 enables account takeover.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-384
• Attack Vector: Network
• Attack Complexity: High
• Privileges Required: None
• User Interaction: Required
• Exploit Status: poc
• CISA KEV Status: Not Listed

Affected Systems

• python-social-auth ecosystem
• social-auth-core < 5.0.0
• social-app-django installations utilizing partial pipelines

Mitigation Strategies

• Upgrade dependency social-auth-core to version 5.0.0 or higher.
• Replace legacy @partial decorator with stateful @partial_step with secure defaults.
• Require explicit user interaction / confirmation page for any cross-session (external) pipeline resume flows.

Remediation Steps:

1. Run pip install --upgrade social-auth-core>=5.0.0 to secure python-social-auth installations.
2. Review custom pipelines for legacy @partial usages and migrate to @partial_step.
3. Configure any pipeline step intended for email validation with allow_external_resume=True and verify confirmation template endpoints are correctly integrated.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-57179
• https://www.cve.org/CVERecord?id=CVE-2026-57179
• https://github.com/python-social-auth/social-core/security/advisories/GHSA-vqg6-3fw6-j9jg
• https://github.com/python-social-auth/social-core
• https://github.com/python-social-auth/social-core/commit/0418782454ac7bbc6a9230ea21f7f5066fe89686
• https://github.com/python-social-auth/social-core/pull/1816
• https://github.com/python-social-auth/social-app-django/pull/1009
• https://github.com/python-social-auth/social-docs/pull/444
• https://github.com/python-social-auth/social-core/releases/tag/5.0.0

---

Read the full report for CVE-2026-57179 on our website for more details including interactive diagrams and full exploit analysis.