PT-2025-41492 · Unknown+1 · Python Social Auth+1

Mel-Mason + 1 · Published 2025-10-09 · Updated 2026-04-07 · CVE-2025-61783

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.6.0

Description Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, a user could be associated by email during authentication even if the associate by email pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided email addresses or does not require unique email addresses.

Recommendations Update to version 5.6.0 or later. Review the authentication service policy on email addresses.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-303

CWE-290

Related Identifiers

CVE-2025-61783

GHSA-WV4W-6QV2-QQFG

OPENSUSE-SU-2026:10499-1

Affected Products

Debian

Python Social Auth

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61783.json · Exploit
• 🔥 https://github.com/python-social-auth/social-app-django/issues/220 · Exploit
• 🔥 https://github.com/python-social-auth/social-app-django/issues/231 · Exploit
• 🔥 https://github.com/python-social-auth/social-app-django/issues/634 · Exploit
• https://cve.org/CVERecord?id=CVE-2025-61783 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-61783 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-61783 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-61783 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10499-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61783 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61783 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-61783 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wv4w-6qv2-qqfg · Vendor Advisory
• https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-wv4w-6qv2-qqfg · Note
• https://github.com/python-social-auth/social-app-django/pull/803 · Note