SAML Vulnerability in Python Social Auth affecting User Account Security

CVE-2026-57175

What is CVE-2026-57175?

The vulnerability in Python Social Auth relates to its SAML backend, which inadequately verifies SAML responses on the Assertion Consumer Service endpoint. Prior to version 5.0.0, the system would accept SAML responses without verifying them against a previous AuthnRequest, creating a potential attack vector. This flaw could enable an attacker with a legitimate account on a trusted Identity Provider (IdP) to associate their SAML identity with a legitimate user's account. Consequently, the attacker could authenticate via SAML and gain unauthorized access to the victim's account. The issue has been addressed in version 5.0.0 by implementing validation of SAML responses against stored AuthnRequest IDs.

References