Python Social Auth’s Vend OAuth2 backend used only the numeric vend user_id as the social‑auth UID. In applications that connect to more than one Vend shop, merchants whose internal user IDs overlap could have their accounts mapped to the same social‑auth record. The result is that a user from one shop could be authenticated as the local account that was originally associated with the same numeric user ID from another shop, enabling unauthorized access to that account. The weakness allows an attacker to takeover an account without needing the password, presenting a confidentiality and integrity risk.

Users running python-social-auth:social-core before version 5.0.0 and employing the Vend OAuth2 backend with multiple shops are affected. The issue is fixed in version 5.0.0 and later releases.

The vulnerability has a CVSS score of 6.8, indicating moderate severity. An EPSS score of 0.00219 (less than 1%) indicates a very low exploit probability. It is not listed in the CISA KEV catalog. Exploitation requires an attacker to be able to interact with the application’s Vend backends from more than one shop; the attack vector is therefore application‑oriented and requires that the malicious actor has control or access to at least one shop’s Vend credentials.