Python Social Auth’s LoginRadius backend previously failed to validate the OAuth state parameter during authentication. This omission enabled a login CSRF attack, letting an attacker coercively complete a user’s login flow with an attacker-controlled token, effectively authenticating the victim as the attacker’s LoginRadius account. The resulting impact is unauthorized access to the victim’s session and any resources tied to that identity.

Applications that integrate the python-social-auth:social-core package via its LoginRadius backend and are running a version older than 5.0.0 are susceptible. Versions 5.0.0 and newer include state validation, rendering the issue resolved.

The calculated CVSS score of 4.3 indicates moderate severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a social login flow where the attacker supplies a forged authentication request, exploiting the missing state check.