Cross-Site Request Forgery in Social-auth-core SAML Backend by Python-Social-Auth
CVE-2026-126775

2.3LOW

Key Information:

Vendor

Python-social-auth

Status
Social-auth-core
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126775?

The SAML backend of Social-auth-core versions prior to 7.0.0 contains a vulnerability that allows attackers to perform cross-site request forgery. By exploiting an unsigned RelayState parameter, attackers can issue a valid Identity Provider (IdP) response, which, when embedded in an auto-submitting form, signs in victims to the attacker's account. This can lead to unauthorized access and potentially compromise sensitive information entered by the victim.

Affected Version(s)

social-auth-core 4.7.0 < 7.0.0

social-auth-core 7.0.0

References

https://github.com/python-social-auth/social-core/securit...
vendor-advisory
https://github.com/python-social-auth/social-core/pull/2167
patchissue-tracking
https://github.com/python-social-auth/social-core/commit/...
patch

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zachariah Mithani (AploSec)
.