CVE-2026-115910: 
Python vulnerability analysis and mitigation

CVE-2026-115910 is an OpenID Connect nonce session-binding flaw in Python Social Auth (social-auth-core) that allows an attacker who obtains a victim's unused authorization code to authenticate as that victim. The vulnerability affects social-auth-core versions up to and including 6.1.1; version 6.2.0 contains the fix. It was published on October 26, 2026, with the underlying fix merged on October 20, 2026. The CVSS v3.1 base score is 6.8 (Medium/Moderate), reflecting high confidentiality and integrity impact but requiring high attack complexity and user interaction (GitHub Advisory, Feedly).

The root cause is classified as CWE-345 (Insufficient Verification of Data Authenticity) and CWE-384 (Session Fixation). In social_core/backends/open_id_connect.py, get_and_store_nonce stores the OIDC nonce in a shared OpenIdConnectAssociation table keyed only by server URL and nonce handle — not by the browser session or OAuth state that initiated the login. The validate_claims function then accepts any stored, unexpired nonce from this global table without verifying it was issued to the completing browser session. Additionally, OpenIdConnectAuth sets DEFAULT_USE_PKCE = False, overriding the OAuth2 base class default of True, meaning PKCE — which would independently block authorization code injection — is disabled by default. An attacker can start their own login to obtain a valid state for their session, then submit the victim's authorization code with that attacker-controlled state; the nonce in the victim's ID token passes validation because it exists globally in the shared table (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to be authenticated to the relying party application as the victim user, achieving full account takeover without knowing the victim's credentials or the client secret. Both confidentiality and integrity are highly impacted: the attacker gains access to all data and functionality available to the victim's account. Availability is not directly affected. Every application using OpenIdConnectAuth or any backend derived from it with default settings (PKCE disabled) is vulnerable, including those using social-auth-app-django and similar integrations (GitHub Advisory).

A proof-of-concept exploit (social_nonce.py with a mock IdP mockidp.py) was published as part of the security advisory by the reporter (uttej-badwane), demonstrating the attack locally against social-auth-core 6.1.1, 6.1.0, and 5.2.0 with Django. The PoC confirms that the attacker's session completes with the victim's code, returning user=victim. No in-the-wild exploitation has been reported, and the EPSS score is 0.0. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to first obtain the victim's unused authorization code (e.g., via Referer headers, proxy logs, browser history, malicious extensions, or open redirects on the callback URL) and requires user interaction from the victim to initiate a login (GitHub Advisory, Feedly).

1. Obtain victim's authorization code: Position to intercept the victim's unused OIDC authorization code — via Referer header leakage from the callback URL, proxy/server logs, browser history sync, a malicious browser extension, or an open redirect on the callback endpoint.
2. Victim initiates login: The victim starts an OIDC login flow through the vulnerable application, causing the IdP to issue an authorization code tied to the victim's nonce (stored globally in OpenIdConnectAssociation).
3. Attacker starts their own login: The attacker initiates a separate login in their own browser against the same application, obtaining a valid state value bound to their own session.
4. Submit victim's code with attacker's state: The attacker sends a crafted callback request to the application's OIDC callback endpoint (e.g., /complete/oidc/) supplying the victim's authorization code (code=<victim_code>) and the attacker's own state parameter.
5. Bypass nonce validation: The application redeems the victim's code at the IdP token endpoint, receiving an ID token containing the victim's nonce. Because validate_claims checks only that the nonce exists and is unexpired in the global OpenIdConnectAssociation table (not that it belongs to the attacker's session), validation passes.
6. Authenticated as victim: The attacker's browser session is now authenticated as the victim user, granting full account access (GitHub Advisory).

• Logs: OIDC callback requests (e.g., /complete/oidc/) where the state parameter does not match the session that initiated the corresponding login flow; successful authentication events for a user account from an IP or session that did not initiate the original authorization request.
• Application Logs: Authentication success log entries for a user immediately following a failed or abandoned login attempt by that same user from a different session or IP address.
• Network: Unusual or duplicate OIDC callback requests to the relying party's callback endpoint with the same code parameter submitted from different source IPs or sessions; requests to the callback endpoint with a state value that does not correspond to any pending login in the originating session.
• Session/Database: Entries in the OpenIdConnectAssociation table where a nonce is consumed by a session other than the one that created it (detectable after patching to version 6.2.0, which now binds nonces to sessions).

Upgrade social-auth-core to version 6.2.0, which binds the OIDC nonce to the initiating browser session and OAuth2 state, and also verifies the nonce against the session-stored value before accepting it. Note that in-progress OIDC logins at the time of upgrade must restart. As an interim workaround prior to upgrading, explicitly enable PKCE for the OIDC backend by setting SOCIAL_AUTH_OIDC_USE_PKCE = True (or the equivalent per-backend setting), which independently blocks authorization code injection even without the nonce fix. Operators should also audit callback URLs for open redirects and review proxy/server log configurations to minimize authorization code leakage vectors (GitHub Advisory, Release 6.2.0).

The vulnerability was reported by security researcher uttej-badwane and remediated by nijel (a maintainer), who merged the fix on October 20, 2026. The advisory notes that the flaw violates OIDC Core section 15.5.2 and RFC 9700 section 4.5, which specify that nonces must prevent authorization code injection. The fix was well-received by the community, with the reporter thanking the maintainer for the prompt patch (GitHub PR #2141).