{"id":"CVE-2026-115910","revision":"9cc4ddf23793418daef2516112865c37","records":[{"revision":"9cc4ddf23793418daef2516112865c37","observedAt":"2026-10-26T17:35:31.029+00:00","statement":{"source":"cve-program","id":"CVE-2026-115910","aliases":[],"title":"Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim","description":"Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in social_core/backends/open_id_connect.py uses get_and_store_nonce to place the OpenID Connect nonce in a shared OpenIdConnectAssociation table, and get_nonce and validate_claims verify only that the nonce exists and has not expired rather than binding it to the browser session and OAuth state that initiated the login. An attacker who obtains a victim's unused authorization code can start a separate login to obtain valid state for the attacker's browser, submit the victim's code with that state, and pass nonce validation because the victim nonce is globally available. With DEFAULT_USE_PKCE disabled in the default OpenIdConnectAuth configuration, the attacker can be logged in as the victim. This issue is fixed in version 6.2.0.","state":0,"publishedAt":"2026-10-26T16:44:34.337+00:00","modifiedAt":"2026-10-26T16:44:34.337+00:00","affected":[{"ecosystem":"Vendor product","name":"social-core","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"python-social-auth\",\n                    \"product\": \"social-core\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 6.2.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","score":6.8,"severity":"MEDIUM"}],"references":["https://github.com/python-social-auth/social-core/security/advisories/GHSA-h2r5-x5m7-3935","https://github.com/python-social-auth/social-core/pull/2141","https://github.com/python-social-auth/social-core/commit/c2f2ae4663bef19ee8b07f2cf5a2344f9155d826","https://github.com/python-social-auth/social-core/releases/tag/6.2.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115910","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-115910","identifiers":["CVE-2026-115910"]},"retained":false,"historicalAffected":[]}],"coverage":[]}