Listen to this Post
CVE-2026-57179 is a session fixation vulnerability (CWE-384) in the Python Social Auth library, specifically within its partial-pipeline resume mechanism. The flaw exists in all versions prior to 5.0.0. The core issue is that the `partial_token` used to resume a multi-step authentication flow was accepted as a bearer credential without being cryptographically or logically bound to the browser session that originally created it. This means the token functioned as a standalone, portable credential rather than a session-bound state artifact. An attacker could initiate an authentication flow with their own account on a target application using the library. During this process, the system generates a valid `partial_token` and associated verification data for steps such as `mail_validation` or custom steps decorated with @partial. Because the token is not tied to the originating session, the attacker can trick a victim into resuming that same flow using the victim’s own browser. This is typically achieved through social engineering or cross-site request forgery (CSRF) vectors, where the victim’s browser is directed to a URL containing the attacker-controlled partial_token. When the victim’s browser submits this token, the server validates it based on its content and expiration but fails to check whether the current session matches the one that originally created the token. Consequently, the application authenticates the victim’s browser as the attacker’s account, effectively hijacking the victim’s session and associating it with the attacker’s identity provider data. The vulnerability is classified as CWE-384 (Session Fixation) and also relates to CWE-270 (Privilege Context Switching). The CVSS 3.1 base score is 4.2, with a vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N, indicating a medium severity issue that requires network access, high attack complexity, no privileges, and user interaction. The primary impact is on confidentiality and integrity, both rated low, with no availability impact. Applications that rely on resumable partial pipeline steps are affected. The issue was fixed in version 5.0.0 by binding partial pipeline resumes to the originating browser session, ensuring that a `partial_token` can only be used from the same session context in which it was issued. Workarounds for applications that cannot upgrade immediately include disabling resumable partial pipeline steps entirely, particularly `mail_validation` and custom `@partial` steps, or avoiding acceptance of partial resume links from untrusted contexts. There is no complete workaround while continuing to use the vulnerable mechanism. The vulnerability was reported through GitHub private vulnerability reporting by Liyi Zhou, Ziyue Wang, Strick, Maurice, and Chenchen Yu from the University of Sydney security research team.
DailyCVE Form:
Platform: Python Social Auth
Version: Prior 5.0.0
Vulnerability: Session Fixation
Severity: Medium
date: 2026-09-24
Prediction: Patched in 5.0.0
What Undercode Say:
Check installed version pip show social-auth-core pip show social-auth-app-django Inspect partial pipeline configuration grep -r "partial" settings.py grep -r "mail_validation" settings.py Example vulnerable view using partial token from social_django.views import complete The complete view accepts partial_token as a GET parameter without session binding check in versions < 5.0.0
Custom partial step decorated with @partial
from social_core.pipeline.partial import partial
@partial
def custom_validation(backend, details, user=None, args, kwargs):
This step can be resumed using a partial_token
In vulnerable versions, token is not bound to session
return {'partial_token': backend.strategy.session_get('partial_token')}
Exploit: (Educational Purposes!)
Step 1: Attacker initiates authentication flow POST /login/social/backend/ The server returns a partial_token in the URL or response Step 2: Attacker extracts partial_token Example token: 3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d Step 3: Attacker crafts malicious link https://target.com/complete/backend/?partial_token=3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d Step 4: Victim clicks link Victim's browser resumes attacker's authentication flow Server authenticates victim as attacker
Protection: from this CVE
Upgrade to Python Social Auth version 5.0.0 or later, which binds partial pipeline resumes to the originating browser session.
If immediate upgrade is not possible, disable resumable partial pipeline steps entirely, including `mail_validation` and any custom steps decorated with @partial.
If resumable flows are required, avoid accepting partial resume links from untrusted contexts until a patched version can be deployed.
Implement additional CSRF protections and validate that the `partial_token` is presented from the same session that initiated the flow.
Monitor for suspicious authentication patterns, such as a single browser session switching between multiple identity provider accounts.
Impact:
The vulnerability allows an attacker to start an authentication flow, obtain a valid `partial_token` and verification data, and cause a victim’s browser to resume that attacker-controlled flow. This results in the victim’s browser being authenticated as the attacker’s account. The primary impact is session fixation, leading to account takeover where the victim operates within the attacker’s account context. This can lead to privacy violations, data exfiltration, or further exploitation depending on the privileges associated with the attacker’s account. The confidentiality and integrity impacts are rated low, and there is no availability impact. The attack requires network access, high complexity, no privileges, and user interaction to succeed.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
