Python Social Auth’s LINE backend accepts an authorization code without verifying the returned OAuth state, creating a cross‑site request forgery condition (CWE‑352) and a mismatch of untrusted input (CWE‑358). An attacker can initiate a social login flow from a malicious LINE account and lure a victim to the crafted callback URL, resulting in the victim’s browser authenticating with the attacker’s account. If account linking is enabled, the same flaw can persist the attacker’s identity on the victim’s existing account, establishing a permanent unauthorized login path.

Applications that have python‑social‑auth:social‑core installed with the LINE backend enabled are impacted. Versions prior to 5.0.2 lack state validation; upgrading to 5.0.2 or later removes the flaw.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of <1% signals a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. The attack vector requires only the victim’s interaction with the crafted callback URL; no additional privileges are necessary.