CVE-2026-126775: Social-auth-core 4.7.0 before 7.0.0 Login CSRF via SAML RelayState
Social-auth-core 4.7.0 before 7.0.0 contains a login cross-site request forgery vulnerability in the SAML backend that restores sessions named in the unsigned RelayState parameter. Attackers can deliver their own valid IdP response and RelayState to a victim's browser via an auto-submitting form, signing the victim into the attacker's account to capture entered data.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the SAML backend in Social-auth-core versions 4.7.0 through versions before 7.0.0 are affected. The issue concerns restoration of sessions identified by an unsigned RelayState parameter.
What does an attacker need to exploit it?
The attacker needs their own valid IdP response and a RelayState value, and must cause a victim's browser to submit them, such as through an auto-submitting form. No attacker privileges are indicated, but victim interaction is required.
What is the practical impact of a successful attack?
The victim can be logged into the attacker's account rather than their own. Data the victim enters while using that account may then be captured by the attacker.