CVE-2026-115910

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 6.2.0

Description In the OpenIdConnectAuth component within social core/backends/open id connect.py, the get and store nonce function stores the OpenID Connect nonce in a shared OpenIdConnectAssociation table. The get nonce() and validate claims() functions only verify the existence and expiration of the nonce, failing to bind it to the specific browser session and OAuth state that initiated the login. If DEFAULT USE PKCE is disabled, an attacker who obtains a victim's unused authorization code can initiate a separate login to obtain a valid state for their own browser and submit the victim's code. Because the victim's nonce is globally available, the validation passes, allowing the attacker to log in as the victim.

Recommendations Update Python Social Auth to version 6.2.0. Enable DEFAULT USE PKCE in the OpenIdConnectAuth configuration to mitigate the risk.