Python Social Auth’s partial‑pipeline resume mechanism allowed an attacker to begin an authentication flow, capture a partial token, and later cause a victim’s browser to resume that flow. Because the partial‑token credential was not tied to the original browser session, the victim’s session was authenticated as the attacker’s chosen account without the victim’s knowledge. The vulnerability is a session fixation flaw that can lead to unauthorized access or account takeover.

The issue resides in the python‑social‑auth social‑core package for any version prior to 5.0.0. Applications that use resumable partial pipeline steps such as mail_validation or custom steps decorated with @partial are affected. Affected environments include any web applications that integrate this library for social authentication.

With a CVSS score of 4.2 the impact is moderate, and the EPSS score of less than 1 % indicates a very low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog and no public exploit is documented. However, the attack would require the attacker to initiate a partial authentication flow and supply the victim with a link or prompt, making the vector a remote social‑login manipulation. The potential for impersonating a user’s account warrants prompt remediation.