CVE-2026-57178: social-auth-core - VK App Backend Accepts Unsigned Callback Data
Summary
CVE-2026-57178: social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing. Affects social-auth-core versions < 5.0.0. Fixed in 5.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
social-auth-core is a Python library that provides a framework for social authentication in web applications. It supports various social platforms, allowing developers to integrate authentication via services like VK, Facebook, and Google. The VK App backend specifically facilitates authentication through VK applications, enabling users to log in using their VK credentials. However, this backend has a critical vulnerability that can expose applications to unauthorized access.
Vulnerability Detail
The vulnerability arises from the VK App backend's acceptance of callback data without verifying its signature when the 'auth_key' parameter is missing. This flaw allows an attacker to send unsigned data, which the application may mistakenly treat as verified VK identity information. As a result, an attacker could manipulate callback fields such as 'viewer_id', 'access_token', 'api_id', and 'api_result', potentially gaining unauthorized access as any VK user. This issue is particularly concerning as it undermines the integrity of the authentication process.
How To Fix
Latest published version: 6.2.0 as of 23 Oct 2026
pip install --upgrade "social-auth-core==6.2.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.0.0
This is the first release that contains the fix.
pip install --upgrade "social-auth-core==5.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, applications can disable the VK App backend by removing 'social_core.backends.vk.VKAppOAuth2' from the 'SOCIAL_AUTH_AUTHENTICATION_BACKENDS' setting in your configuration file. This will prevent the use of the vulnerable backend until an upgrade can be performed.
Conclusion
The vulnerability identified as CVE-2026-57178 in the social-auth-core package poses a significant risk to applications using the VK App backend. It allows attackers to exploit unsigned callback data, potentially leading to unauthorized access. Users are strongly encouraged to upgrade to the patched version 5.0.0 or later to secure their applications.
See every vulnerability recorded for social-auth-core →
FAQ
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
An attacker could impersonate any VK user, leading to unauthorized access and potential data breaches.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, you can disable the VK App backend in your application settings to mitigate the risk until you can upgrade.
The vulnerability was reported by a user with the handle @lalalala5678 through GitHub's private vulnerability reporting system.
References
Related vulnerabilities
Recent vulnerabilities recorded for social-auth-core.
