Python Social Auth - Django has unsafe account association
### Impact Upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses. ### Patches * https://github.com/python-social-auth/social-app-django/pull/803 ### Workarounds Review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-61783US | — | — | ||
Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the `associate… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/python-social-auth/social-app-djangoPACKAGE
- https://github.com/python-social-auth/social-app-django/commit/10c80e2ebabeccd4e9c84ad0e16e1db74148ed4cWEB
- https://github.com/python-social-auth/social-app-django/issues/220WEB
- https://github.com/python-social-auth/social-app-django/issues/231WEB
- https://github.com/python-social-auth/social-app-django/issues/634WEB
- https://github.com/python-social-auth/social-app-django/pull/803WEB
- https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-wv4w-6qv2-qqfgWEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-61783ADVISORY
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan