Bug 2560959 (CVE-2026-115910)

Summary: CVE-2026-115910 social-auth-core: social-auth-core: Account takeover via improper OpenID Connect nonce binding
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: dschmidt, jlanda, jmitchel, jwong, kshier, omaciel, rbobbitt, simaishi, stcannon, tguha, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in social-auth-core. The OpenID Connect authentication backend stores nonces (single-use security tokens used to prevent replay attacks) in a shared table without binding them to the initiating browser session and authentication state. A remote attacker who obtains a victim's unused authorization code can start a separate login session and submit the victim's code to pass validation. This vulnerability allows the attacker to log in as the victim, resulting in account takeover and unauthorized access.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2566061, 2566063, 2566066    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-26 17:02:51 UTC 
Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in social_core/backends/open_id_connect.py uses get_and_store_nonce to place the OpenID Connect nonce in a shared OpenIdConnectAssociation table, and get_nonce and validate_claims verify only that the nonce exists and has not expired rather than binding it to the browser session and OAuth state that initiated the login. An attacker who obtains a victim's unused authorization code can start a separate login to obtain valid state for the attacker's browser, submit the victim's code with that state, and pass nonce validation because the victim nonce is globally available. With DEFAULT_USE_PKCE disabled in the default OpenIdConnectAuth configuration, the attacker can be logged in as the victim. This issue is fixed in version 6.2.0.