Listen to this Post
The vulnerability resides in the Vend OAuth2 backend of the python-social-auth library, specifically within versions prior to 5.0.0. The core issue is an identity binding flaw where the backend uses only the numeric Vend `user_id` as the social-auth UID. This means that when multiple Vend shops authenticate through the same application, users from different shops who share the same internal Vend user ID will generate identical social-auth UIDs. Consequently, these users collide in the social-auth association table. An attacker from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop. This effectively allows an account takeover across different Vend shops. The issue affects any application using the Vend OAuth2 backend that connects to more than one Vend shop. The root cause is the lack of scoping for the social-auth UID; it does not incorporate the shop identifier. The fix introduced in version 5.0.0 scopes the Vend social-auth UIDs by shop, ensuring uniqueness. Users are advised to upgrade to the patched version. For applications that cannot upgrade immediately, workarounds include restricting the Vend OAuth2 backend to a single trusted Vend shop. Alternatively, if Vend authentication is not required, the backend can be disabled by removing it from SOCIAL_AUTH_AUTHENTICATION_BACKENDS. However, there is no complete workaround while continuing to allow authentication from multiple Vend shops with the vulnerable backend. The vulnerability was reported through GitHub private vulnerability reporting by Liyi Zhou, Ziyue Wang, Strick, Maurice, and Chenchen Yu from the University of Sydney security research team. The CVSS v3.1 score is 6.8, categorized as Medium.
DailyCVE Form:
Platform: Vend OAuth2
Version: Prior 5.0.0
Vulnerability: Numeric UID collision
Severity: Medium
date: 2026-09-24
Prediction: 2026-09-24
What Undercode Say:
Analytics:
pip show social-auth-core
python -c "from social_core.backends.vend import VendOAuth2; print(VendOAuth2.get_user_id({'user_id': 123}))"
grep -r "user_id" social_core/backends/vend.py
Exploit: (Educational Purposes!)
An attacker can exploit this vulnerability by authenticating to a Vend shop that shares the same numeric user ID as a victim’s account in another shop. If the application uses the vulnerable Vend OAuth2 backend, the attacker’s social-auth UID will collide with the victim’s UID in the association table. The attacker may then gain access to the victim’s local account. This requires the attacker to have a valid Vend shop account with a user ID that matches the victim’s user ID in a different shop connected to the same application.
Protection: from this CVE
Upgrade to python-social-auth version 5.0.0 or later. If immediate upgrade is not possible, restrict the Vend OAuth2 backend to a single trusted Vend shop. Disable the Vend backend by removing it from `SOCIAL_AUTH_AUTHENTICATION_BACKENDS` if Vend authentication is not needed. Avoid using the vulnerable backend with multiple Vend shops.
Impact:
Successful exploitation allows an attacker to bypass authentication and gain unauthorized access to a user’s account. This can lead to account takeover, data exposure, and potential privilege escalation within the application. The integrity and confidentiality of the affected user’s data are compromised.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
