CVE-2026-62322: social-auth-core - Login CSRF in LINE backend due to Missing OAuth State Validation
Summary
CVE-2026-62322: Impact Applications using the LINE Login backend are vulnerable to login CSRF / forced authentication. Affects social-auth-core versions < 5.0.2. Fixed in 5.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
social-auth-core is a Python library that provides a framework for social authentication in web applications. It supports various authentication backends, allowing developers to integrate social login features easily. However, the LINE backend in social-auth-core has a vulnerability that can lead to login CSRF attacks, where an attacker can impersonate a victim by exploiting the OAuth state validation mechanism.
Vulnerability Detail
The vulnerability arises from the LINE Login backend's failure to validate the OAuth state parameter during the authorization callback. An attacker can initiate a LINE authorization flow and trick a victim into visiting the callback URL with the attacker's authorization code. This flaw allows the application to accept a forged callback, logging the victim in as the attacker-controlled LINE account. If account linking is enabled, this vulnerability can also allow the attacker to link their LINE identity to the victim's authenticated account, creating a persistent unauthorized access path.
How To Fix
Latest published version: 6.2.0 as of 23 Oct 2026
pip install --upgrade "social-auth-core==6.2.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.0.2
This is the first release that contains the fix.
pip install --upgrade "social-auth-core==5.0.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, the only workaround is to disable the LINE backend in your application if it is not essential. This will prevent any potential exploitation of the vulnerability until the package is updated.
Conclusion
The CVE-2026-62322 vulnerability in the social-auth-core package's LINE backend poses a significant risk of login CSRF attacks due to missing OAuth state validation. It is crucial for developers using this package to update to version 5.0.2 or later to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for social-auth-core →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If left unaddressed, this vulnerability can allow attackers to gain unauthorized access to user accounts, potentially leading to data breaches and loss of user trust.
While the primary risk is unauthorized access, it could lead to data loss if attackers manipulate user accounts or access sensitive information.
The vulnerability was reported by Ta Duc Thien and Duc Anh Nguyen via GitHub.
References
Related vulnerabilities
Recent vulnerabilities recorded for social-auth-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
