Python Social Auth’s SAML backend accepted responses on the Assertion Consumer Service endpoint without first confirming that a previously requested AuthnRequest was present. This flaw allowed an attacker with a legitimate account on a trusted Identity Provider to link the attacker’s SAML identity to a victim’s local account. By doing so the attacker could authenticate as the victim through SAML and gain the victim’s privileges. The weakness is an Improper Authentication flaw (CWE-287).

The vulnerability affects all deployments of python-social-auth: social-core that use the SAML backend with authenticated account association before version 5.0.0. The problem was fixed in version 5.0.0 by validating SAML responses against stored AuthnRequest IDs.

The CVSS score of 6.4 indicates moderate severity. The EPSS score is below 1%, suggesting a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker needs a valid account on a trusted IdP and the ability to send a crafted SAML response to the ACS endpoint; no additional internal privileges are required for the exploitation to succeed.