{
  "id": 17066145,
  "title": "CVE-2026-115910: CVE-2026-115910: OpenID Connect Session-Binding Bypass and Account Takeover in Python Social Auth",
  "url": "https://urgent.news/2026/10/29/cve-2026-115910-cve-2026-115910-openid-connect-session-binding-bypass",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-29T13:30:50.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/cverports/cve-2026-115910-cve-2026-115910-openid-connect-session-binding-bypass-and-account-takeover-in-2p8k"
  },
  "original_language": "en",
  "account": "A security flaw has been discovered in Python Social Auth, a popular open-source library for implementing social login functionality in Python applications. The vulnerability, identified as CVE-2026-115910, allows attackers to bypass OpenID Connect session-binding and potentially carry out account takeover attacks.\n\nThe issue lies in the library's handling of OpenID Connect nonces, which are used to prevent replay attacks during the authentication process. According to the advisory, Python Social Auth versions prior to 6.2.0 fail to properly associate these nonces with the specific user sessions they were generated for. As a result, an attacker who intercepts an unused authorization code can inject it into their own authentication flow, essentially impersonating the victim and gaining full control of their account.\n\nTo exploit this vulnerability, an attacker would need to intercept a session's unused authorization code and then use it to inject a valid nonce into their own authentication request. This would allow them to bypass the nonce validation check and gain unauthorized access to the victim's account.\n\nThe development team behind Python Social Auth has released a patch in version 6.2.0 of the library, which addresses the issue by binding OpenID Connect nonces to the initiating browser session and rejecting authorization codes from other login attempts. Additionally, enabling Proof Key for Code Exchange (PKCE) on all OpenID Connect authentication backends is recommended to further enhance security.\n\nThe CVSS scoring system rates this vulnerability as having a medium severity level (CVSS 3.1 score of 6.8) due to its potential impact on confidentiality and integrity, although the attack complexity and required privileges are considered high. The exploit has been demonstrated with a proof-of-concept (POC) implementation, but no known attacks have been reported in the wild at this time.",
  "summary": "CVE-2026-115910: OpenID Connect Session-Binding Bypass and Account Takeover in Python Social Auth Vulnerability ID: CVE-2026-115910 CVSS Score: 6.8 Published: 2026-10-28 A session-binding vulnerability in Python Social Auth (social-core) versions prior to 6.2.0 allows an attacker to perform authorization code injection against the OpenID Connect authentication backend. By storing generated OIDC…",
  "key_points": [
    "Attackers can bypass OpenID Connect session-binding in Python Social Auth.",
    "Vulnerability allows account takeover via intercepted authorization codes.",
    "Patch released in version 6.2.0 to fix nonce handling and nonce validation."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}