Listen to this Post
CVE-2026-57175 is an improper authentication vulnerability affecting the Python Social Auth library, specifically the `social-core` package, prior to version 5.0.0. The flaw resides in the SAML backend implementation, which handles authentication assertions from external Identity Providers (IdPs). The core issue is that the SAML backend accepted SAML responses on the Assertion Consumer Service (ACS) endpoint without verifying that they matched a previously issued AuthnRequest. In a standard SAML 2.0 flow, the Service Provider (SP) generates an `AuthnRequest` containing a unique ID and stores it in the user’s session. When the IdP responds with a signed SAML assertion, the SP must validate the `InResponseTo` attribute in the assertion against the stored `AuthnRequest` ID to ensure the response corresponds to the request that was actually initiated. The vulnerable versions of python-social-auth failed to perform this critical validation step. The library simply accepted any validly signed SAML response sent to the ACS endpoint, without confirming that it was a response to a request the application had generated for the current user session. This omission effectively decoupled the authentication response from its initiating context. An attacker with a valid account on a trusted IdP could exploit this flaw by crafting or reusing a SAML assertion and submitting it to the vulnerable SP’s ACS endpoint. Because the backend did not validate that the response matched an `AuthnRequest` associated with the currently logged-in victim’s session, it would erroneously associate the attacker’s IdP identity with the victim’s local account. The vulnerability specifically affects applications that use the SAML backend together with authenticated account association. This configuration allows users to link their existing local accounts to external identities. Once the attacker’s SAML identity is linked to the victim’s account, the attacker can authenticate through SAML and gain unauthorized access to the victim’s account. The issue aligns with CWE-287 (Improper Authentication) and relates to ATT&CK technique T1098 (Account Manipulation). The severity is rated as Medium with a CVSS v3.1 base score of 6.4. The vulnerability was reported through GitHub private vulnerability reporting by Liyi Zhou, Ziyue Wang, Strick, Maurice, and Chenchen Yu from the University of Sydney security research team. The issue has been fixed in version 5.0.0 by validating SAML responses against stored `AuthnRequest` IDs.
DailyCVE Form:
Platform: python-social-auth
Version: <5.0.0
Vulnerability: SAML AuthnRequest validation bypass
Severity: Medium
date: 2026-09-24
Prediction: 2026-09-24
What Undercode Say:
Analytics:
Check installed version of social-core pip show social-core | grep Version Search for SAML backend configuration in Django settings grep -r "SOCIAL_AUTH_SAML" /path/to/project/settings/ Identify if SAML account association is enabled grep -r "SOCIAL_AUTH_SAML_ENABLED_IDPS" /path/to/project/
Vulnerable SAML backend logic (simplified representation) def validate_saml_response(self, response): Missing: Check response InResponseTo against stored AuthnRequest ID The code proceeds to authenticate the user without this validation return self.authenticate(response)
Exploit: (Educational Purposes!)
Attacker with valid IdP account crafts a SAML assertion and submits it to the victim's ACS endpoint The vulnerable backend accepts the response without validating that it corresponds to a previously issued AuthnRequest Result: Attacker's SAML identity is linked to victim's local account
Protection: from this CVE
Upgrade to python-social-auth social-core version 5.0.0 or later. This version implements strict validation of SAML responses against stored `AuthnRequest` IDs. Applications that cannot upgrade immediately should disable SAML account association for already authenticated users. If SAML login is not required, the SAML backend can be disabled by removing it from SOCIAL_AUTH_AUTHENTICATION_BACKENDS. There is no complete workaround while continuing to allow vulnerable SAML account association.
Impact:
The SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker’s SAML identity to a logged-in victim’s local account. The attacker could then authenticate through SAML and gain access to the victim’s account. The issue affects applications using the SAML backend together with authenticated account association. Patches: The issue has been fixed by validating SAML responses against stored AuthnRequest IDs. Users should upgrade to a patched version.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
