Authentication Bypass in Python Social Auth by Python Social Auth Team

CVE-2026-57179

What is CVE-2026-57179?

Prior to version 5.0.0, Python Social Auth's mechanism for resuming partial pipelines allowed an attacker to exploit the partial_token. This token was accepted as a bearer credential without being tied to the originating browser session. This flaw enabled attackers to initiate an authentication flow, acquire a valid partial token, and subsequently manipulate a victim's browser to resume the attacker's flow, impersonating the attacker’s account. The vulnerability particularly impacts applications utilizing resumable partial pipeline steps, like mail_validation, or custom steps marked with the @partial decorator. The issue was addressed in version 5.0.0, which introduced session binding for partial pipeline resumes.

References