CVE-2026-126775 · Package
NO FIX YET · SEE WHAT TO DO
social-auth-core is a Python library that adds social and SSO logins to web apps. In its SAML backend, the unsigned RelayState parameter can restore a session, so an attacker can sign a victim into the attacker's own account and capture data the victim enters.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Web applications that use social-auth-core 4.7.0 up to but not including 7.0.0 with the SAML authentication backend are exposed. Applications that use only OAuth or other non-SAML backends, or that do not use this library, can skip it.
Not affected if no-saml-backend, non-python
Who cares django, flask, python, saml, social-auth
pip show social-auth-coresocial-auth-core in requirements.txt, poetry.lock or Pipfile.lock and see whether it is version 4.7.0 or later and before 7.0.0social_core.backends.saml)social-auth-core 7.0.0Social-auth-core 4.7.0 before 7.0.0 contains a login cross-site request forgery vulnerability in the SAML backend that restores sessions named in the unsigned RelayState parameter. Attackers can deliver their own valid IdP response and RelayState to a victim's browser via an auto-submitting form, signing the victim into the attacker's account to capture entered data.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.