Description
Social-auth-core 4.7.0 before 7.0.0 contains a login cross-site request forgery vulnerability in the SAML backend that restores sessions named in the unsigned RelayState parameter. Attackers can deliver their own valid IdP response and RelayState to a victim's browser via an auto-submitting form, signing the victim into the attacker's account to capture entered data.
Published: 2026-11-11
Score: 2.3 Low
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 11 Nov 2026 19:00:00 +0000

Type Values Removed Values Added
Description Social-auth-core 4.7.0 before 7.0.0 contains a login cross-site request forgery vulnerability in the SAML backend that restores sessions named in the unsigned RelayState parameter. Attackers can deliver their own valid IdP response and RelayState to a victim's browser via an auto-submitting form, signing the victim into the attacker's account to capture entered data.
Title Social-auth-core 4.7.0 before 7.0.0 Login CSRF via SAML RelayState
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-11T18:41:07.737Z

Reserved: 2026-11-11T18:27:27.098Z

Link: CVE-2026-126775

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-11T19:17:38.110

Modified: 2026-11-11T19:17:38.110

Link: CVE-2026-126775

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses