Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)
Impact
Applications using the LINE Login backend are vulnerable to login CSRF / forced authentication. An attacker can start a LINE authorization flow for an account they control and trick a victim into visiting the callback URL with the attacker’s authorization code. Because the LINE backend did not validate the returned OAuth state, the application could accept the forged callback and log the victim in as the attacker-controlled LINE account.
If account linking is enabled, the same flaw can allow an attacker to link their LINE identity to a victim’s existing authenticated account, creating a persistent unauthorized login path.
Patches
Workarounds
Only applications that enable the LINE backend are affected.
Credits
Thanks to Ta Duc Thien and Duc Anh Nguyen for reproting this via GitHub.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | social-auth-core | < 5.0.2 | 5.0.2 |
References
- https://github.com/python-social-auth/social-core/security/advisories/GHSA-526j-582w-7fm9
- https://github.com/python-social-auth/social-core/pull/1829
- https://github.com/python-social-auth/social-core/commit/5b3b90d07ebccc1f5b076445b27ea35ec059764b
- https://github.com/python-social-auth/social-core
- https://github.com/python-social-auth/social-core/releases/tag/5.0.2
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N- Weakness (CWE)
CWE-352- Platform
- Python (PyPI)
- Package
social-auth-core- Disclosed
- 15.10.2026
- Updated
- 22.10.2026 18:07
Sources and licenses
OSV / GitHub Advisory Database - GHSA-526j-582w-7fm9 - CC BY 4.0
Vulnerability history: social-auth-core
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 6
- First → latest
- 09.2026 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 5
Disclosures per year
- 2026: 6
-
Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign) this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.