CVE-2026-62322

Python Social Auth is a social authentication/registration mechanism.

Published Oct 15, 2026 · updated Oct 15, 2026 · python-social-auth social-core

### Impact Applications using the LINE Login backend are vulnerable to login CSRF / forced authentication. An attacker can start a LINE authorization flow for an account they control and trick a victim into visiting the callback URL with the attacker’s authorization code. Because the LINE backend did not validate the returned OAuth state, the application could accept the forged callback and log the victim in as the attacker-controlled LINE account. If account linking is enabled, the same flaw can allow an attacker to link their LINE identity to a victim’s existing authenticated account, creating a persistent unauthorized login path. ### Patches * https://github.com/python-social-auth/social-core/pull/1829 ### Workarounds Only applications that enable the LINE backend are affected. ### Credits Thanks to Ta Duc Thien and Duc Anh Nguyen for reproting this via GitHub.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

Oct 15, 2026 · NIST NVD
Detected
Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resulting callback URL, causing the application to log the victim into the attacker's account. When account lin
Oct 15, 2026 · GitHub Advisory Database
Fix available
social-auth-core fixed in 5.0.2
Oct 15, 2026 · GitHub Advisory Database
Fix available
social-auth-core fixed in 5.0.2
Oct 15, 2026 · GitHub Advisory Database
Updated
### Impact Applications using the LINE Login backend are vulnerable to login CSRF / forced authentication. An attacker can start a LINE authorization flow for an account they control and trick a victim into visiting the callback URL with the attacker’s authorization code. Because the LINE backend did not validate the returned OAuth state, the application could accept the forged callback and log th
Oct 15, 2026 · OSV.dev
Fix available
social-auth-core fixed in 5.0.2-1
Oct 15, 2026 · OSV.dev
Fix available
social-auth-core fixed in 5.0.2-1
Oct 15, 2026 · OSV.dev
Updated
### Impact Applications using the LINE Login backend are vulnerable to login CSRF / forced authentication. An attacker can start a LINE authorization flow for an account they control and trick a victim into visiting the callback URL with the attacker’s authorization code. Because the LINE backend did not validate the returned OAuth state, the application could accept the forged callback and log th

Affected

Debian:12 social-auth-core4.3.0-1, 4.4.2-1, 4.4.2-2
Debian:13 social-auth-core4.6.1-1, 4.8.1-1, 4.8.3-1
Debian:14 social-auth-core0 → 5.0.2-1
PyPI social-auth-core0 → 5.0.2
pypi social-auth-coreversion unspecified
vendor python-social-auth social-coreversion unspecified

Sources

CVE.orgVulnerability recordCVE-2026-62322
Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to v
cve.org
GitHub Advisory DatabasePackage advisoryGHSA-526j-582w-7fm9
GitHub Advisory Database record mirrored by OSV.
github.com
GitLab Advisory DatabasePackage advisoryCVE-2026-62322
Applications using the LINE Login backend are vulnerable to login CSRF / forced authentication. An attacker can start a LINE authorization flow for an account they control and trick a victim into visiting the callback URL with the attacker’s authorization code. Because the LINE backend did not validate the returned OAuth state, the application could accept the forged callback and log the victim in
advisories.gitlab.com
NIST NVDVulnerability recordCVE-2026-62322
Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to v
nvd.nist.gov
OSV.devPackage advisoryDEBIAN-CVE-2026-62322
osv.dev
OSV.devPackage advisoryGHSA-526j-582w-7fm9
Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)
osv.dev