CVE-2026-115910: CVE-2026-115910: OpenID Connect Session-Binding Bypass and Account Takeover in Python Social Auth

A security flaw has been discovered in Python Social Auth, a popular open-source library for implementing social login functionality in Python applications. The vulnerability, identified as CVE-2026-115910, allows attackers to bypass OpenID Connect session-binding and potentially carry out account takeover attacks.

The issue lies in the library's handling of OpenID Connect nonces, which are used to prevent replay attacks during the authentication process. According to the advisory, Python Social Auth versions prior to 6.2.0 fail to properly associate these nonces with the specific user sessions they were generated for. As a result, an attacker who intercepts an unused authorization code can inject it into their own authentication flow, essentially impersonating the victim and gaining full control of their account.

To exploit this vulnerability, an attacker would need to intercept a session's unused authorization code and then use it to inject a valid nonce into their own authentication request. This would allow them to bypass the nonce validation check and gain unauthorized access to the victim's account.

The development team behind Python Social Auth has released a patch in version 6.2.0 of the library, which addresses the issue by binding OpenID Connect nonces to the initiating browser session and rejecting authorization codes from other login attempts. Additionally, enabling Proof Key for Code Exchange (PKCE) on all OpenID Connect authentication backends is recommended to further enhance security.

The CVSS scoring system rates this vulnerability as having a medium severity level (CVSS 3.1 score of 6.8) due to its potential impact on confidentiality and integrity, although the attack complexity and required privileges are considered high. The exploit has been demonstrated with a proof-of-concept (POC) implementation, but no known attacks have been reported in the wild at this time.