Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in social_core/backends/open_id_connect.py uses get_and_store_nonce to place the OpenID Connect nonce in a shared OpenIdConnectAssociation table, and get_nonce and validate_claims verify only that the nonce exists and has not expired rather than binding it to the browser session and OAuth state that initiated the login. An attacker who obtains a victim's unused authorization code can start a separate login to obtain valid state for the attacker's browser, submit the victim's code with that state, and pass nonce validation because the victim nonce is globally available. With DEFAULT_USE_PKCE disabled in the default OpenIdConnectAuth configuration, the attacker can be logged in as the victim. This issue is fixed in version 6.2.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0,
    OpenIdConnectAuth in social_core/backends/open_id_connect.py uses get_and_store_nonce to place the OpenID
    Connect nonce in a shared OpenIdConnectAssociation table, and get_nonce and validate_claims verify only
    that the nonce exists and has not expired rather than binding it to the browser session and OAuth state
    that initiated the login. An attacker who obtains a victim's unused authorization code can start a
    separate login to obtain valid state for the attacker's browser, submit the victim's code with that state,
    and pass nonce validation because the victim nonce is globally available. With DEFAULT_USE_PKCE disabled
    in the default OpenIdConnectAuth configuration, the attacker can be logged in as the victim. This issue is
    fixed in version 6.2.0. (CVE-2026-115910)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0,     OpenIdConnectAuth in social_core/backends/open_id_connect.py uses get_and_store_nonce to place the OpenID     Connect nonce in a shared OpenIdConnectAssociation table, and get_nonce and validate_claims verify only     that the nonce exists and has not expired rather than binding it to the browser session and OAuth state     that initiated the login. An attacker who obtains a victim's unused authorization code can start a     separate login to obtain valid state for the attacker's browser, submit the victim's code with that state,     and pass nonce validation because the victim nonce is globally available. With DEFAULT_USE_PKCE disabled     in the default OpenIdConnectAuth configuration, the attacker can be logged in as the victim. This issue is     fixed in version 6.2.0. (CVE-2026-115910)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
477766	SCA: security update for social-auth-core (GHSA-h2r5-x5m7-3935)	Tenable Cloud Security	SCA Checks	Local	medium
477766	SCA: security update for social-auth-core (GHSA-h2r5-x5m7-3935)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
372218	Linux Distros Unpatched Vulnerability : CVE-2026-115910	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-115910

medium

Tenable Plugins

medium

medium

medium