CVE-2026-57178: 
Python 취약성 분석 및 완화

CVE-2026-57178 is an authentication bypass vulnerability in Python Social Auth's vk-app backend (social-auth-core) that allows unauthenticated attackers to forge VK identity callbacks and authenticate as arbitrary VK user IDs. The flaw affects all versions of social-auth-core prior to 5.0.0 and was first published on June 30, 2026, with NVD publication on September 24, 2026. It carries a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper authentication (CWE-287) combined with improper verification of cryptographic signatures (CWE-347). The vk-app backend in Python Social Auth processed VK application callback data without checking for the presence or validity of the auth_key HMAC signature parameter — when auth_key was simply omitted from the callback request, the backend accepted the remaining fields (viewer_id, access_token, api_id, api_result) as trusted VK identity data. An attacker can craft an HTTP callback request to the VK app callback endpoint with arbitrary values for these fields, effectively impersonating any VK user ID without possessing valid credentials or a legitimate VK session. The fix (PR #1811) enforces that auth_key must be present and cryptographically valid before any callback data is trusted (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to authenticate to any application using the vk-app backend as an arbitrary VK user, resulting in full account takeover for targeted users. This yields high confidentiality impact (access to victim account data and session) and high integrity impact (ability to perform actions as the impersonated user), with no availability impact. The scope is limited to applications that have deployed the social_core.backends.vk.VKAppOAuth2 backend; applications using other Python Social Auth backends are not affected (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.0016 (0.16%), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The attack complexity is rated High, as the attacker must be able to submit a crafted callback to the application's VK callback endpoint, which may require knowledge of the target application's callback URL (GitHub Advisory).

1. Reconnaissance: Identify web applications using Python Social Auth's vk-app backend (social_core.backends.vk.VKAppOAuth2) by examining login pages, OAuth flow redirects, or publicly visible configuration references.
2. Locate the VK callback endpoint: Determine the application's VK app callback URL (typically something like /complete/vk-app/ or as configured in SOCIAL_AUTH_VK_APP_COMPLETE_URL).
3. Craft a malicious callback request: Construct an HTTP POST request to the callback endpoint that includes attacker-chosen fields such as viewer_id (set to the target VK user ID), access_token, api_id, and api_result, while deliberately omitting the auth_key parameter.
4. Submit the forged callback: Send the crafted request to the application. Because the vulnerable backend does not enforce the presence of auth_key, it accepts the unsigned data as a verified VK identity.
5. Achieve authentication: The application creates or resumes a session for the specified viewer_id, granting the attacker access as the impersonated VK user (GitHub Advisory).

• Network: HTTP POST requests to the VK app callback endpoint (e.g., /complete/vk-app/) that lack an auth_key parameter but include viewer_id, access_token, api_id, and/or api_result fields; requests originating from IPs with no prior VK OAuth flow initiation.
• Logs: Application authentication logs showing successful VK logins for user IDs that have no corresponding prior OAuth initiation or redirect from VK; repeated authentication attempts for different viewer_id values from the same source IP.
• Application Behavior: New or unexpected user sessions associated with VK user IDs that the legitimate account holders did not initiate; account activity (logins, data access) at unusual times or from unexpected geolocations for VK-linked accounts.

Upgrade social-auth-core to version 5.0.0 or later, which enforces that auth_key must be present and valid before any VK callback data is trusted (GitHub Advisory). For applications that cannot upgrade immediately, the only effective workaround is to disable the vk-app backend entirely by removing social_core.backends.vk.VKAppOAuth2 from SOCIAL_AUTH_AUTHENTICATION_BACKENDS — there is no complete mitigation while continuing to use the vulnerable backend. Additionally, consider implementing network-level controls to restrict which sources can submit VK callback requests, and validate authentication claims through the VK API where feasible.

The vulnerability was reported by researcher @lalalala5678 through GitHub's private vulnerability reporting program and remediated by maintainer nijel (GitHub Advisory). Red Hat tracked the issue via Bugzilla (Bug 2540600) and assigned it high severity/priority (Red Hat Bugzilla). No significant broader media coverage or notable social media discussion has been observed at this time.