CVE-2026-57177: 
Python 취약성 분석 및 완화

CVE-2026-57177 is a login Cross-Site Request Forgery (CSRF) vulnerability in the LoginRadius backend of Python Social Auth (social-auth-core). Prior to version 5.0.0, the LoginRadius backend failed to validate the OAuth state parameter during the authentication flow, allowing an attacker to trick a victim's browser into completing authentication using an attacker-controlled LoginRadius token. The vulnerability was reported by researchers from the University of Sydney and published on June 30, 2026, with NVD publication on September 24, 2026. Only applications explicitly using the LoginRadius backend are affected. It carries a CVSS v3.1 base score of 4.3 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is the absence of OAuth state parameter validation in the LoginRadius backend of social-auth-core, classified as CWE-352 (Cross-Site Request Forgery) and CWE-358 (Improperly Implemented Security Check for Standard). In a standard OAuth flow, the state parameter is a CSRF token that binds the authorization request to the callback; without this check, an attacker can initiate an OAuth flow with their own LoginRadius account, capture the callback URL, and then trick a victim into visiting that URL — causing the victim's session to be authenticated as the attacker's identity (a "login CSRF" or "session fixation via OAuth" attack). The fix in version 5.0.0 (commit 4d33282, PR #1808) enables callback state validation for the LoginRadius backend (Github Advisory).

Successful exploitation results in a victim's browser session being authenticated as the attacker's LoginRadius identity, effectively logging the victim into the attacker's account. This constitutes an integrity impact — the attacker can observe actions the victim takes while logged in as the attacker (e.g., submitted forms, uploaded data, purchases), and may use this to harvest sensitive information entered by the victim. There is no direct confidentiality or availability impact, and the scope is limited to applications that have explicitly configured the LoginRadius backend (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability requires user interaction (the victim must click a crafted link or visit an attacker-controlled page), which limits opportunistic exploitation. The EPSS score is approximately 0.108%, indicating a low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was responsibly disclosed through GitHub's private vulnerability reporting program by a University of Sydney security research team (Github Advisory).

1. Reconnaissance: Identify a target web application that uses python-social-auth (social-auth-core < 5.0.0) with the LoginRadius backend enabled.
2. Attacker initiates OAuth flow: The attacker begins a LoginRadius OAuth authentication flow on the target application using their own LoginRadius account, obtaining a valid callback URL containing an attacker-controlled authorization code/token.
3. Craft malicious link: The attacker captures the OAuth callback URL (e.g., https://target-app.com/complete/loginradius/?code=ATTACKER_CODE&state=...) before it is consumed, or crafts a page that causes the victim's browser to navigate to this URL.
4. Deliver to victim: The attacker tricks the victim into visiting the crafted callback URL via phishing, a malicious webpage, or an embedded resource (e.g., <img> tag or redirect).
5. Session takeover: Because the LoginRadius backend does not validate the state parameter, the victim's browser completes the OAuth callback, and the application authenticates the victim's session as the attacker's LoginRadius identity.
6. Harvest victim actions: The attacker can now observe or benefit from any actions the victim takes while unknowingly logged in as the attacker's account (Github Advisory).

• Logs: Application authentication logs showing a user session authenticated via the LoginRadius backend with a callback request that lacks a state parameter or contains a mismatched state value.
• Logs: Multiple OAuth callback requests (/complete/loginradius/) originating from different IP addresses but completing with the same authorization code or token.
• Network: Unexpected or anomalous referrers in OAuth callback requests to the LoginRadius completion endpoint, particularly from external or unrecognized domains.
• Application Behavior: User accounts reporting unexpected login sessions or activity they did not initiate, particularly via the LoginRadius authentication path.

The primary remediation is to upgrade social-auth-core to version 5.0.0 or later, which enables callback state validation for the LoginRadius backend (PR #1808) (Github Advisory). For applications that cannot upgrade immediately, the recommended workaround is to disable the LoginRadius backend entirely by removing it from the SOCIAL_AUTH_AUTHENTICATION_BACKENDS Django/application setting — there is no complete mitigation while the vulnerable backend remains active (Github Advisory). Applications not using the LoginRadius backend are not affected and require no action.

The vulnerability was responsibly disclosed through GitHub's private vulnerability reporting program by a security research team from the University of Sydney (Liyi Zhou, Ziyue Wang, Strick, Maurice, and Chenchen Yu). Red Hat has tracked the issue via Bugzilla (Bug 2540597) and assigned it medium severity. No significant broader media coverage or notable community debate has been observed, consistent with the moderate severity rating and narrow scope of impact (Github Advisory, Red Hat Bugzilla).