Bug 2540587 (CVE-2026-57175)

Summary: CVE-2026-57175 social-auth-core: social-auth-core: Account takeover via unverified SAML responses
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: dschmidt, ikhan, jlanda, jmitchel, jwong, kshier, omaciel, rbobbitt, simaishi, stcannon, ttakamiy, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in social-auth-core. The Security Assertion Markup Language (SAML) backend accepts authentication responses without verifying that they correspond to a previously issued authentication request. A remote authenticated attacker with a valid account on a trusted Identity Provider (IdP) can exploit this flaw in applications using SAML account association to link their identity to a logged-in victim's account. This allows the attacker to authenticate through SAML and gain unauthorized access to the victim's account.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-24 17:28:21 UTC 
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued `AuthnRequest`. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML identity to a logged-in victim's local account. The attacker could then authenticate through SAML and gain access to the victim's account. The issue affects applications using the SAML backend together with authenticated account association. The issue has been fixed in version 5.0.0 by validating SAML responses against stored `AuthnRequest` IDs.