UBUNTU-CVE-2026-126775: Medium severity ubuntu/social-auth-core vulnerability
Social-auth-core 4.7.0 before 7.0.0 contains a login cross-site request forgery vulnerability in the SAML backend that restores sessions named in the unsigned RelayState parameter. Attackers can deliver their own valid IdP response and RelayState to a victim's browser via an auto-submitting form, signing the victim into the attacker's account to capture entered data.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the SAML backend in social-auth-core versions from 4.7.0 up to, but not including, 7.0.0 are exposed. The issue concerns session restoration based on an unsigned RelayState parameter.
What does an attacker need to exploit it?
An attacker needs their own valid identity-provider response and a RelayState value naming a session. They can send these to a victim's browser in an auto-submitting form.
What is the impact on a victim?
The victim can be signed into the attacker's account rather than their own. Data the victim enters while using that account may then be captured by the attacker.
What version resolves the issue?
The affected range ends before version 7.0.0, so version 7.0.0 is not listed as affected.