Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

python-social-auth/social-core

              master @ 4101a75
            

Fixes

CVEs

HIGH

Peak severity

28.6%

Coverage

Highlights

Auth Bypass: 9 prior fixes. Scrutinize any change in this area.

social_core/utils.py: most-fixed (3 issues). Treat as high-risk during review.

10 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The Azure AD backend decoded JSON Web Tokens (JWT) without performing signature verification using the provider's JWKS, enabling remote identity spoofing. Developers must verify signatures, issuers, and audiences against trust material before relying on token claims.

Auth Bypass: SAML responses were processed without confirming that the InResponseTo field matched the initiated AuthnRequest ID from the user session, enabling replay and unauthorized login bypass. Ensure all backends validate transaction-specific correlation identifiers.

Cross-Site Request Forgery: Multiple social backends failed to enable or validate the OAuth 2.0 state parameter on authentication callbacks, exposing users to login-CSRF. Backends must systematically enforce state checks.