CVE-2026-57175

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.0.0

Description The SAML backend accepts SAML responses on the Assertion Consumer Service endpoint without verifying that they match a previously issued AuthnRequest. This flaw allows an attacker with a valid account on a trusted Identity Provider (IdP) to link their SAML identity to a logged-in victim's local account when SAML account association is enabled. Consequently, the attacker can authenticate via SAML to gain unauthorized access to the victim's account.

Recommendations Update to version 5.0.0 or later. Disable SAML account association for already authenticated users. Remove the SAML backend from SOCIAL AUTH AUTHENTICATION BACKENDS if SAML login is not required.