Listen to this Post
The `vk-app` backend in `social-auth-core` versions prior to 5.0.0 fails to enforce signature verification when the `auth_key` parameter is omitted from VK callback data. The backend’s `auth_complete` method retrieves the `auth_key` from the request but only verifies it if the value is present, effectively treating a missing key as a valid state. An attacker can therefore send a crafted callback that entirely omits the `auth_key` field, along with arbitrary values for viewer_id, access_token, api_id, and api_result. Because the signature check is skipped, the library accepts these attacker-controlled parameters as a trusted VK identity, allowing authentication as any VK user ID. The vulnerability is classified as CWE-287 (Improper Authentication) and CWE-347 (Improper Verification of Cryptographic Signature). The CVSS v3.1 score is 7.4, with a vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. The issue affects only applications using the `vk-app` backend, and a patch was released in version 5.0.0 that requires `auth_key` to be present and valid before callback data is trusted.
DailyCVE Form:
Platform: social-auth-core
Version: < 5.0.0
Vulnerability: Authentication bypass
Severity: High
date: 2026-09-24
Prediction: 2026-09-24
What Undercode Say
Bash:
pip show social-auth-core | grep Version
Python (vulnerable code):
social_core/backends/vk.py (pre-5.0.0)
auth_key = self.data.get("auth_key")
if auth_key:
check_key = vk_sig(f"{key}<em>{self.data.get('viewer_id')}</em>{secret}")
if check_key != auth_key:
raise ValueError("VK.com authentication failed: invalid auth key")
Python (patched code):
social_core/backends/vk.py (5.0.0)
auth_key = self.data.get("auth_key")
if not auth_key:
raise AuthFailed(self, "Missing auth key")
check_key = vk_sig(f"{key}<em>{self.data.get('viewer_id')}</em>{secret}")
if check_key != auth_key:
raise AuthFailed(self, "Invalid auth key")
Exploit: (Educational Purposes!)
curl -X POST "https://target.example.com/complete/vk-app/" \ -d "viewer_id=123456789" \ -d "access_token=attacker_token" \ -d "api_id=attacker_api_id" \ -d "api_result=attacker_api_result"
Protection: from this CVE
Upgrade to social-auth-core >= 5.0.0. If upgrade is not possible, remove `social_core.backends.vk.VKAppOAuth2` from `SOCIAL_AUTH_AUTHENTICATION_BACKENDS` to disable the vulnerable backend.
Impact:
An unauthenticated remote attacker can impersonate any VK user, leading to full account takeover on applications that rely on the `vk-app` backend for authentication.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
