https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T01:40:46.520911+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-61783 CVE-2025-61783 — Python Social Auth - Django has unsafe account association 2026-10-03T01:40:46.557931+00:00

Affected: python-social-auth social-app-django

Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses. Version 5.6.0 contains a patch. As a workaround, review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-wv4w-6qv2-qqfg GHSA-wv4w-6qv2-qqfg — Python Social Auth - Django has unsafe account association 2026-10-03T01:40:46.558016+00:00

Affected: PyPI: social-auth-app-django

### Impact

Upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses.

### Patches

* https://github.com/python-social-auth/social-app-django/pull/803

### Workarounds

Review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.