https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 09:05:09 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-255183 EUVD-2026-255183 https://cve.radiocsirt.org/vuln/euvd-2026-255183 https://cve.radiocsirt.org/vuln/fkie_cve-2025-61783 <p>Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn&#39;t require unique e-mail addresses. Version 5.6.0 contains a patch. As a workaround, review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.</p> <p>Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn&#39;t require unique e-mail addresses. Version 5.6.0 contains a patch. As a workaround, review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-61783 https://cve.radiocsirt.org/vuln/ghsa-wv4w-6qv2-qqfg <p><strong>Affected:</strong> PyPI: social-auth-app-django</p> <p>### Impact</p> <p>Upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn&#39;t require unique e-mail addresses.</p> <p>### Patches</p> <p>* https://github.com/python-social-auth/social-app-django/pull/803</p> <p>### Workarounds</p> <p>Review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.</p> <p><strong>Affected:</strong> PyPI: social-auth-app-django</p> <p>### Impact</p> <p>Upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn&#39;t require unique e-mail addresses.</p> <p>### Patches</p> <p>* https://github.com/python-social-auth/social-app-django/pull/803</p> <p>### Workarounds</p> <p>Review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.</p> https://cve.radiocsirt.org/vuln/ghsa-wv4w-6qv2-qqfg https://cve.radiocsirt.org/vuln/opensuse-su-2026:10499-1 <p>python311-social-auth-app-django-5.7.0-1.1 on GA media</p> <p>python311-social-auth-app-django-5.7.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10499-1 https://cve.radiocsirt.org/vuln/pysec-2026-1932 <p><strong>Affected:</strong> PyPI: social-auth-app-django</p> <p>### Impact</p> <p>Upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn&#39;t require unique e-mail addresses.</p> <p>### Patches</p> <p>* https://github.com/python-social-auth/social-app-django/pull/803</p> <p>### Workarounds</p> <p>Review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.</p> <p><strong>Affected:</strong> PyPI: social-auth-app-django</p> <p>### Impact</p> <p>Upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn&#39;t require unique e-mail addresses.</p> <p>### Patches</p> <p>* https://github.com/python-social-auth/social-app-django/pull/803</p> <p>### Workarounds</p> <p>Review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1932 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-61783 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: social-auth-app-django, Ubuntu:22.04:LTS: social-auth-app-django, Ubuntu:24.04:LTS: social-auth-app-django, Ubuntu:25.10: social-auth-app-django, Ubuntu:26.04:LTS: social-auth-app-django</p> <p>Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn&#39;t require unique e-mail addresses. Version 5.6.0 contains a patch. As a workaround, review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: social-auth-app-django, Ubuntu:22.04:LTS: social-auth-app-django, Ubuntu:24.04:LTS: social-auth-app-django, Ubuntu:25.10: social-auth-app-django, Ubuntu:26.04:LTS: social-auth-app-django</p> <p>Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn&#39;t require unique e-mail addresses. Version 5.6.0 contains a patch. As a workaround, review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-61783