Cross-Site Request Forgery in Python Social Auth's LINE Backend

CVE-2026-62322

What is CVE-2026-62322?

The LINE backend of Python Social Auth, prior to version 5.0.2, suffers from a vulnerability where it fails to validate the returned OAuth state during the authorization code exchange. An attacker can exploit this flaw by initiating authorization with a malicious LINE account and tricking a victim into visiting a crafted callback URL. This can result in the victim being logged into the attacker's account. Furthermore, if account linking is enabled, the lack of state validation allows the attacker's LINE identity to be linked to the victim's account, establishing a persistent unauthorized access pathway. This issue is resolved in version 5.0.2.

References