Technical impact
The vulnerability lies in the OpenIdConnectAuth backend of python‑social‑auth’s social‑core package prior to version 6.2.0. The OpenID Connect nonce is stored globally and examined only for existence and expiration, never for association with the browser session or OAuth state that initiated the login. An attacker who obtains a victim’s unused authorization code can start a separate login flow that generates a valid state for the attacker’s session, submit the victim’s code together with that state, and the nonce verification succeeds because the nonce is globally available. This allows the attacker to be logged in as the victim, resulting in unauthorized account access. The flaw reflects insecure implementation of authentication request validation (CWE‑303), improper verification of data authenticity (CWE‑345), and lack of session scope enforcement for OAuth (CWE‑384).
Affected Systems
Python‑social‑auth:social‑core, all versions preceding 6.2.0. Applications that have integrated this package for OpenID Connect authentication and have not upgraded to 6.2.0 or later are affected.
Risk and Exploitability
The CVSS score of 6.8 denotes medium severity. The EPSS score is below 1% and the vulnerability is not listed in CISA's KEV catalog, indicating no widespread exploitation reports. If an attacker can acquire an unused authorization code issued to a victim, they can replay that code in a separate session and satisfy nonce validation, resulting in successful impersonation. The likely attack vector is inferred as a credential replay attack using the stolen authorization code, though the CVE description does not specify the exact method for obtaining the code.
Github GHSA