CVE-2026-57177

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.0.0

Description The LoginRadius backend fails to validate the OAuth state during the authentication flow. This leads to a login Cross-Site Request Forgery (CSRF), where an attacker can force a victim's browser session to authenticate using a token controlled by the attacker. Consequently, the victim becomes authenticated as the attacker's LoginRadius identity. This issue specifically affects applications utilizing the LoginRadius backend.

Recommendations Update to version 5.0.0 or later. As a temporary workaround, disable the LoginRadius backend by removing it from SOCIAL AUTH AUTHENTICATION BACKENDS.