A flaw in the VK application backend of the python-social-auth social-core library allows an attacker to supply unsigned callback data when the auth_key parameter is omitted. The backend then accepts this data as a verified VK identity. This results in an authentication bypass, enabling the attacker to impersonate an arbitrary VK user and obtain fields such as viewer_id, access_token, api_id, and api_result. The weakness is defined by CWE‑287 (Improper Authentication) and CWE‑347 (Missing or Incorrect Signature Verification).

The issue affects any application that uses the vk‑app backend provided by the python-social-auth:social-core package. Versions earlier than 5.0.0 are vulnerable; starting with 5.0.0 the backend requires a valid auth_key before any callback data is trusted.

The CVSS score is 7.4, indicating a high severity due to the potential for unauthorized access. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no publicly known exploits yet. Attackers can exploit the flaw remotely by constructing a malicious VK callback and directing the application to process it when auth_key is missing. The vulnerability’s impact is limited to authentication, but the compromised credentials could allow further actions within the application.