CVE-2026-57178

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.0.0

Description The vk-app backend fails to verify the callback signature when the auth key parameter is omitted. This allows an attacker to provide unsigned, controlled data that the application treats as a verified VK identity. By manipulating callback fields such as viewer id, access token, api id, and api result, an attacker could potentially authenticate as any arbitrary VK user ID. This issue specifically affects applications utilizing the vk-app backend.

Recommendations Update to version 5.0.0 or later. As a temporary workaround, disable the vk-app backend by removing social core.backends.vk.VKAppOAuth2 from SOCIAL AUTH AUTHENTICATION BACKENDS.