social-auth-core vulnerabilities

CVEs whose affected-version data names the social-auth-core package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-115910Medium· 6.8

1w ago

Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the …

Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim

▾ Sunlitsocial-auth-core · social-auth-coreEPSS 0.16%via OSV