CVE-2026-57176: social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend
Impact
The Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID.
When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop.
The issue affects applications using the Vend OAuth2 backend with more than one Vend shop.
Patches
The issue has been fixed by scoping Vend social-auth UIDs by shop.
Users should upgrade to a patched version.
Fix:
https://github.com/python-social-auth/social-core/pull/1795
Workarounds
Applications that cannot upgrade immediately should restrict the Vend OAuth2 backend to a single trusted Vend shop.
If Vend authentication is not required, the Vend backend can also be disabled by removing it from SOCIALAUTHAUTHENTICATIONBACKENDS.
There is no complete workaround while continuing to allow authentication from multiple Vend shops with the vulnerable backend.
Credits
Reported through GitHub private vulnerability reporting by Liyi Zhou, Ziyue Wang, Strick, Maurice, and Chenchen Yu from the University of Sydney security research team.
Reporter references:
https://lzhou1110.github.io/ https://zyy0530.github.io/ https://str1ckl4nd.github.io/ https://maurice.busystar.org/ https://7thparkk.github.io/
Other sources
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop. The issue affects applications using the Vend OAuth2 backend with more than one Vend shop. Version 5.0.0 patches the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/social-auth-coreto a version that resolves this vulnerability.Fixed in 5.0.0 - Upgrade
Upgrade
social-auth-coreto a version that resolves this vulnerability.Fixed in 5.0.0 - Configuration
Restrict the Vend OAuth2 backend to a single trusted Vend shop if upgrading is not immediately possible.
Vend OAuth2 backend allowed Vend shops = single trusted Vend shop - Configuration
If Vend authentication is not required, disable the Vend backend by removing it from SOCIAL_AUTH_AUTHENTICATION_BACKENDS.
Python Social Auth SOCIAL_AUTH_AUTHENTICATION_BACKENDS = Vend backend omitted
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using the Vend OAuth2 backend with more than one Vend shop are affected. The collision occurs when different shops have users sharing the same numeric Vend user ID.
What must an attacker be able to do to exploit the flaw?
The attacker needs to authenticate through a Vend shop using the same application and have a numeric Vend user ID that matches one already associated with a local account from another Vend shop. This can cause the attacker to be authenticated as that existing local account.
Are single-shop Vend OAuth2 deployments affected?
The described issue requires multiple Vend shops authenticating through the same application. The provided information does not indicate that a deployment using only one Vend shop is affected.
What version resolves the issue?
social-auth-core version 5.0.0 patches the issue.