Python Social Auth allows an attacker to start an authentication flow, capture a partial token and its verification data, then trick a victim’s browser into resuming that flow. Because the partial-token credential is not bound to the original browser session, the victim’s session becomes authenticated as the attacker’s chosen account. Based on the description, it is inferred that this can lead to unauthorized access to the victim’s data and impersonation without the victim’s knowledge.

The flaw exists in the python-social-auth social-core package for versions older than 5.0.0. Any application that uses the library and partial‑pipeline steps such as mail_validation or custom steps marked with @partial is affected. The issue was patched in 5.0.0, which ties partial pipeline resumes to the originating browser session.

The CVSS score of 4.2 indicates moderate impact, and no EPSS value is supplied. The vulnerability is not listed in CISA’s KEV, and no public exploit has been documented. Based on the description, it is inferred that exploitation would likely require the attacker to initiate a partial authentication flow and supply the victim with a link or request, making the attack vector a remote social‑login manipulation. Based on the description, the potential for account takeover is inferred, warranting prompt remediation.