---
id: CVE-2026-115910
title: >-
  Python Social Auth: OpenID Connect nonce is not bound to the browser session,
  so a stolen authorization code logs the attacker in as the victim
summary: >-
  Python Social Auth is a social authentication and registration mechanism.
  Prior to 6.2.0, OpenIdConnectAuth in social_core/backends/open_id_connect.py
  uses get_and_store_nonce to place the OpenID Connect nonce in a shared
  OpenIdConnectAs…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-345
  - CWE-384
vendor: python-social-auth
product: social-core
affected:
  - social-core < 6.2.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-31T01:33:39.142281Z'
exploitAvailable: true
published: '2026-10-26'
updated: '2026-10-31'
sourceUpdated: '2026-10-31T01:34:08.259Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115910'
references:
  - url: >-
      https://github.com/python-social-auth/social-core/security/advisories/GHSA-h2r5-x5m7-3935
    label: >-
      https://github.com/python-social-auth/social-core/security/advisories/GHSA-h2r5-x5m7-3935
  - url: 'https://github.com/python-social-auth/social-core/pull/2141'
    label: 'https://github.com/python-social-auth/social-core/pull/2141'
  - url: >-
      https://github.com/python-social-auth/social-core/commit/c2f2ae4663bef19ee8b07f2cf5a2344f9155d826
    label: >-
      https://github.com/python-social-auth/social-core/commit/c2f2ae4663bef19ee8b07f2cf5a2344f9155d826
  - url: 'https://github.com/python-social-auth/social-core/releases/tag/6.2.0'
    label: 'https://github.com/python-social-auth/social-core/releases/tag/6.2.0'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-115910'
  - url: 'https://github.com/python-social-auth/social-core'
  - url: 'https://github.com/advisories/GHSA-h2r5-x5m7-3935'
tags:
  - cve.org
  - exploit-available
  - osv
  - pip
  - ghsa
epss: 0.00157
epssPercentile: 0.04851
aliases:
  - GHSA-h2r5-x5m7-3935
ecosystem: pip
patched:
  - social-auth-core 6.2.0
ingestedAt: '2026-10-26T17:33:33.072Z'
---

## Overview

Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in social_core/backends/open_id_connect.py uses get_and_store_nonce to place the OpenID Connect nonce in a shared OpenIdConnectAssociation table, and get_nonce and validate_claims verify only that the nonce exists and has not expired rather than binding it to the browser session and OAuth state that initiated the login. An attacker who obtains a victim's unused authorization code can start a separate login to obtain valid state for the attacker's browser, submit the victim's code with that state, and pass nonce validation because the victim nonce is globally available. With DEFAULT_USE_PKCE disabled in the default OpenIdConnectAuth configuration, the attacker can be logged in as the victim. This issue is fixed in version 6.2.0.

## Affected

- `social-core < 6.2.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-115910)

Affected packages:

- `social-auth-core < 6.2.0`

Patched in:

- `social-auth-core 6.2.0`

Source: https://osv.dev/vulnerability/GHSA-h2r5-x5m7-3935