https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T03:40:30.147619+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-255183 EUVD-2026-255183 2026-10-03T03:40:30.301003+00:00 EUVD-2026-255183 https://cve.radiocsirt.org/vuln/fkie_cve-2025-61783 fkie_cve-2025-61783 2026-10-03T03:40:30.301041+00:00

Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses. Version 5.6.0 contains a patch. As a workaround, review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-wv4w-6qv2-qqfg GHSA-wv4w-6qv2-qqfg — Python Social Auth - Django has unsafe account association 2026-10-03T03:40:30.301077+00:00

Affected: PyPI: social-auth-app-django

### Impact

Upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses.

### Patches

* https://github.com/python-social-auth/social-app-django/pull/803

### Workarounds

Review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10499-1 openSUSE-SU-2026:10499-1 — python311-social-auth-app-django-5.7.0-1.1 on GA media 2026-10-03T03:40:30.301110+00:00

python311-social-auth-app-django-5.7.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2026-1932 PYSEC-2026-1932 — Python Social Auth - Django has unsafe account association 2026-10-03T03:40:30.301131+00:00

Affected: PyPI: social-auth-app-django

### Impact

Upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses.

### Patches

* https://github.com/python-social-auth/social-app-django/pull/803

### Workarounds

Review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-61783 UBUNTU-CVE-2025-61783 2026-10-03T03:40:30.301159+00:00

Affected: Ubuntu:20.04:LTS: social-auth-app-django, Ubuntu:22.04:LTS: social-auth-app-django, Ubuntu:24.04:LTS: social-auth-app-django, Ubuntu:25.10: social-auth-app-django, Ubuntu:26.04:LTS: social-auth-app-django

Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses. Version 5.6.0 contains a patch. As a workaround, review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.