OpenID Connect Nonce Vulnerability in Python Social Auth

CVE-2026-115910

What is CVE-2026-115910?

The OpenID Connect authentication mechanism in Python Social Auth versions prior to 6.2.0 is affected by a vulnerability that allows attackers to exploit the nonce verification process. Specifically, the get_and_store_nonce function improperly stores nonces in a shared table without binding them to the user’s browser session. This flaw enables an attacker, who acquires a victim's unused authorization code, to initiate a separate login process. By leveraging this global nonce availability, the attacker can bypass validation checks and authenticate as the victim. This issue is mitigated in version 6.2.0, where improvements have been made to enforce additional security measures.

References