CVE-2026-62322

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.0.2

Description The LINE backend fails to validate the returned OAuth state during the exchange of an authorization code. This allows an attacker to initiate an authorization flow for an account they control and trick a victim into visiting the callback URL. This results in the victim being logged into the attacker's account, a process known as login CSRF or forced authentication. If account linking is enabled, the attacker can link their LINE identity to the victim's existing account, establishing a persistent unauthorized login path. Only applications with the LINE backend enabled are affected.

Recommendations Update to version 5.0.2. As a temporary mitigation, disable the LINE backend if it is not required.