CVE-2026-57178

Что произошло

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the `vk-app` backend accepted VK application callback data without verifying the callback signature when the `auth_key` parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as `viewer_id`, `access_token`, `api_id`, and `api_result`, potentially allowing authentication as an arbitrary VK user ID. The issue affects only applications using the `vk-app` backend. The issue has been fixed in version 5.0.0 by requiring `auth_key` to be present and valid before callback data is trusted.

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": "< 5.0.0"
}

CVSS: оценки и векторы

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Источники и ссылки

{
  "cwes": [
    "cve"
  ],
  "epss": {
    "source": "epss",
    "received_at": "2026-10-29T09:32:53.281397+00:00"
  },
  "title": {
    "source": "cve",
    "received_at": "2026-10-28T18:47:11.451704+00:00"
  },
  "scores": [
    "cve"
  ],
  "status": {
    "source": "cve",
    "received_at": "2026-10-28T18:47:11.451704+00:00"
  },
  "affected": [
    "cve"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-10-28T18:47:11.451704+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-10-29T09:32:53.281397+00:00"
  },
  "references": [
    "cve"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-10-28T18:47:11.451704+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены29.10.2026, 12:33
2. Опубликована28.10.2026, 21:47

Личная заметка и статус

Другие CVE того же продукта