CVE-2026-57178: social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing
Impact
The vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted.
Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as viewerid, accesstoken, apiid, and apiresult, potentially allowing authentication as an arbitrary VK user ID.
The issue affects only applications using the vk-app backend.
Patches
The issue has been fixed by requiring authkey to be present and valid before callback data is trusted.
Users should upgrade to a patched version.
Fix:
https://github.com/python-social-auth/social-core/pull/1811
Workarounds
Applications that cannot upgrade immediately should disable the vk-app backend by removing socialcore.backends.vk.VKAppOAuth2 from SOCIALAUTHAUTHENTICATIONBACKENDS.
There is no complete workaround while continuing to use the vulnerable backend.
Credits
Reported by @lalalala5678 through GitHub private vulnerability reporting.
Other sources
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as viewerid, accesstoken, apiid, and apiresult, potentially allowing authentication as an arbitrary VK user ID. The issue affects only applications using the vk-app backend. The issue has been fixed in version 5.0.0 by requiring authkey to be present and valid before callback data is trusted.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/social-auth-coreto a version that resolves this vulnerability.Fixed in 5.0.0 - Upgrade
Upgrade
social-auth-coreto a version that resolves this vulnerability.Fixed in 5.0.0 - Configuration
Disable the vk-app backend by removing social_core.backends.vk.VKAppOAuth2 from SOCIAL_AUTH_AUTHENTICATION_BACKENDS.
Python Social Auth vk-app backend SOCIAL_AUTH_AUTHENTICATION_BACKENDS = remove social_core.backends.vk.VKAppOAuth2
Event History
Frequently Asked Questions
Which deployments are affected?
Only applications that use the vk-app backend are affected. The flaw applies to versions of social-auth-core before 5.0.0.
What does an attacker need to exploit this issue?
An attacker can submit VK application callback data with the auth_key parameter omitted. They can control fields including viewer_id, access_token, api_id, and api_result, which may let them be treated as an arbitrary VK user identity.
How can we tell whether our application may be vulnerable?
Check whether the application uses the vk-app backend and runs social-auth-core earlier than 5.0.0. Such deployments may have trusted callback data even when auth_key was absent.
What is the remediation?
Upgrade to social-auth-core 5.0.0. This version requires auth_key to be present and valid before it trusts VK callback data.