Social Authentication Vulnerability in Python Social Auth for Vend OAuth2

CVE-2026-57176

What is CVE-2026-57176?

The Python Social Auth framework for Vend OAuth2 presents a significant vulnerability in versions prior to 5.0.0. The issue arises when different Vend shops authenticate through the same application, as the Vend OAuth2 backend relies solely on a numeric user_id. This could lead to a collision in the social-auth association table, allowing a user from one Vend shop to be mistakenly authenticated as another user sharing the same numeric user_id from a different shop. This flaw could compromise user account security and integrity, particularly in applications managing multiple Vend shops. The vulnerability has been corrected in version 5.0.0, emphasizing the importance of keeping systems updated to ensure robust security.

References