Vulnerabilities for social-auth-core

First version without a known vulnerability: 5.0.0

Details

• GHSA-vqg6-3fw6-j9jg2026-09-24

  social-auth-core has a Session Fixation issue

  Fixed in: 5.0.0

• GHSA-3c93-f73f-qc9h2026-09-24

  social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

  Fixed in: 5.0.0

• GHSA-x7qq-23vw-7pfg2026-09-24

  social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

  Fixed in: 5.0.0

• GHSA-fp7w-m676-w7gc2026-09-24

  social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend

  Fixed in: 5.0.0

• GHSA-vq6g-g6c7-5f2j2026-09-24

  social-auth-core has an Improper Authentication issue

  Fixed in: 5.0.0