---
id: "CVE-2026-115910"
kind: "vulnerability"
aliases: ["CVE-2026-115910"]
title: "Python Social Auth: shared OIDC nonce lets an attacker log in as victim"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["oidc", "package", "python", "social-auth", "web-auth"]
not_affected_if: ["not-using-openid-connect", "pkce-enabled", "version-6.2.0-or-later"]
published_at: "2026-10-26T17:17:18+00:00"
first_seen_at: "2026-10-26T17:31:22+00:00"
updated_at: "2026-10-26T17:33:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115910", "first_seen_at": "2026-10-26T17:31:22+00:00"}]
---

# Python Social Auth: shared OIDC nonce lets an attacker log in as victim

Python Social Auth's OpenID Connect backend stores nonces in a shared table and does not bind them to the browser session or OAuth state, so a nonce can be reused across logins. An attacker holding a victim's unused authorization code can submit it with their own state and be logged in as the victim when PKCE is disabled.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of `social-auth-core` (for example `pip show social-auth-core`) and confirm it is below `6.2.0`.
- Look for `OpenIdConnectAuth` in use and check whether `DEFAULT_USE_PKCE` is disabled or unset in settings.

## Fix

- Upgrade `social-auth-core` to `6.2.0` or later.
- Enable PKCE by setting `DEFAULT_USE_PKCE` to true in the social auth settings as an additional mitigation.

## Timeline

- 2026-10-26T17:31:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115910

## From the sources

Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in social_core/backends/open_id_connect.py uses get_and_store_nonce to place the OpenID Connect nonce in a shared OpenIdConnectAssociation table, and get_nonce and validate_claims verify only that the nonce exists and has not expired rather than binding it to the browser session and OAuth state that initiated the login. An attacker who obtains a victim's unused authorization code can start a separate login to obtain valid state for the attacker's browser, submit the victim's code with that state, and pass nonce validation because the victim nonce is globally available. With DEFAULT_USE_PKCE disabled in the default OpenIdConnectAuth configuration, the attacker can be logged in as the victim. This issue is fixed in version 6.2.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_