CVE-2026-57178: social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing
The vk-app backend accepted VK application callback data without verifying the callback signature when the auth_key parameter was omitted.
Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as viewer_id, access_token, api_id, and api_result, potentially allowing authentication as an arbitrary VK user ID.
The issue affects only applications using the vk-app backend.
References
- github.com/advisories/GHSA-3c93-f73f-qc9h
- github.com/python-social-auth/social-core/commit/1bfacdd0379e5eb46e169a99ab648b835e9bb6a2
- github.com/python-social-auth/social-core/pull/1811
- github.com/python-social-auth/social-core/releases/tag/5.0.0
- github.com/python-social-auth/social-core/security/advisories/GHSA-3c93-f73f-qc9h
- nvd.nist.gov/vuln/detail/CVE-2026-57178
Code Behaviors & Features
Detect and mitigate CVE-2026-57178 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →