The vulnerability exists in the OpenIdConnectAuth backend of the python-social-auth social‑core package prior to version 6.2.0. The OpenID Connect nonce is stored in a shared table and the validation logic only checks its existence and expiration, never tying it to the browser session or OAuth state that started the login. An attacker who obtains an unused authorization code issued to a victim can initiate a separate login flow to generate a valid state for the attacker’s session, submit the victim’s code with that state, and pass the nonce verification because the nonce is globally available. This chain of actions allows the attacker to be logged in as the victim, resulting in unauthorized access. The flaw reflects improper verification of data authenticity (CWE‑345) and a lack of session scope enforcement for OAuth (CWE‑384).

Python Social Auth’s social‑core backend component, specifically OpenID Connect support in versions 6.1.x and earlier. Applications that have integrated python-social-auth/social‑core for social authentication with OpenID Connect and have not updated to version 6.2.0 or later are affected.

The CVSS score of 6.8 denotes a medium severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalogue, indicating no widespread exploitation reports yet. Attackers would need access to an unused authorization code, which can be obtained through phishing, credential compromise, or intercepting network traffic. By creating a separate login that generates a state value tied to the attacker’s session, the attacker can replay the victim’s authorization code and succeed in the nonce validation. This results in successful impersonation of the victim user. The likely attack vector is therefore a credential replay attack facilitated by the misbinding of the nonce to the session.