Security1 hOctober 29, 2026, 20:30

Python Social Auth OIDC session-binding flaw enables account takeover

CVE-2026-115910 (CVSS 6.8) in social-auth-core before 6.2.0 lets attackers inject an intercepted authorization code into their own OIDC flow because nonces are stored globally without binding to the initiating browser session. With PKCE disabled by default, this enables full account takeover. Fixed in 6.2.0; enabling PKCE is recommended.

DEV Community

Open source

Python Social Auth OIDC session-binding flaw enables account takeover

CVE-2026-115910: CVSS 6.8, affects social-auth-core below 6.2.0
Nonces validated against a global table, not the initiating session
PKCE is off by default, easing authorization code injection
Fix in 6.2.0 binds nonce to session and OAuth2 state

#PythonSocialAuth#OpenIDConnect

CVE-2026-89070: MOVEit Transfer auth bypass via replayed OIDC sessions

Security

LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network

Security

CVE-2026-101983: Junos httpd stack overflow enables pre-auth RCE via J-Web

Security

Python Social Auth OIDC session-binding flaw enables account takeover

CVE-2026-89070: MOVEit Transfer auth bypass via replayed OIDC sessions

LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network

CVE-2026-101983: Junos httpd stack overflow enables pre-auth RCE via J-Web

PaperCut flaws enable pre-auth RCE, active exploitation reported