Vulnerability in Python Social Auth vk-app Backend

CVE-2026-57178

What is CVE-2026-57178?

Prior to version 5.0.0, the vk-app backend in Python Social Auth failed to verify the callback signature when the auth_key parameter was not provided. This oversight allowed attackers to exploit unsigned, attacker-controlled data as verified VK identities. Consequently, malicious actors could manipulate critical callback fields such as viewer_id, access_token, api_id, and api_result, effectively enabling unauthorized authentication as any VK user. This vulnerability specifically impacts applications utilizing the vk-app backend, emphasizing the necessity for robust input validation mechanisms to safeguard user identity integrity.

References