CVE-2026-57179: 
Python vulnerability analysis and mitigation

CVE-2026-57179 is a Session Fixation vulnerability in Python Social Auth (social-auth-core) that allows an attacker to hijack a victim's authentication session by abusing the partial-pipeline resume mechanism. The flaw affects all versions of social-core prior to 5.0.0 and was published on September 24, 2026. It was originally reported through GitHub private vulnerability reporting by a University of Sydney security research team and fixed in version 5.0.0. The CVSS v3.1 base score is 4.2 (Moderate) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-384 (Session Fixation) and CWE-613 (Insufficient Session Expiration). The vulnerable partial-pipeline resume mechanism accepted a partial_token as a bearer credential without cryptographically binding it to the originating browser session. This means a partial_token obtained by an attacker during their own authentication flow can be reused to resume that flow in a victim's browser — a classic session fixation pattern. The issue specifically affects applications that use resumable partial pipeline steps such as mail_validation or any custom pipeline step decorated with @partial. The fix in version 5.0.0 binds partial pipeline resumes to the originating browser session, preventing cross-session token reuse (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an unauthenticated attacker to authenticate a victim's browser session as the attacker's own account, effectively performing an account takeover via session fixation. This results in low confidentiality and integrity impact — the victim's browser gains access to the attacker's account data, and the attacker may be able to leverage the victim's actions within the application. Availability is not impacted. The attack is limited in scope to applications using partial pipeline steps, but those applications face a meaningful risk of unauthorized account access (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The attack requires high complexity (the attacker must initiate their own authentication flow and then socially engineer a victim into clicking a crafted resume link) and user interaction, which limits opportunistic exploitation. The EPSS score is approximately 0.00158, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Initiate attacker-controlled authentication flow: The attacker begins a social authentication flow on a target application using Python Social Auth, triggering a partial pipeline step (e.g., mail_validation or a custom @partial-decorated step).
2. Obtain partial token: After initiating the flow, the attacker captures the partial_token value issued by the application — this token is not bound to the attacker's browser session in vulnerable versions.
3. Craft a malicious resume URL: The attacker constructs a URL pointing to the application's partial-pipeline resume endpoint, embedding the captured partial_token as a query parameter or bearer credential (e.g., https://target.app/complete/backend/?partial_token=<attacker_token>).
4. Deliver the link to the victim: The attacker uses phishing, a malicious webpage, or another social engineering technique to cause the victim's browser to navigate to the crafted resume URL.
5. Session fixation achieved: The victim's browser resumes the attacker's authentication flow, completing it in the victim's browser context. The victim's session is now authenticated as the attacker's account, granting the attacker indirect control or the ability to observe the victim's interactions within that account (GitHub Advisory).

• Network: Unusual or repeated requests to partial-pipeline resume endpoints (e.g., URLs containing partial_token parameters) originating from IP addresses different from those that initiated the original authentication flow.
• Logs: Application logs showing a partial_token being consumed by a session with a different origin IP or user-agent than the session that created it; authentication completions for accounts where the initiating and completing requests have mismatched session identifiers.
• Application Behavior: Users reporting unexpected logins or account state changes consistent with accessing another user's account; authentication audit logs showing pipeline resume events without a corresponding pipeline initiation from the same session.

The primary remediation is to upgrade social-auth-core to version 5.0.0 or later, which binds partial pipeline resumes to the originating browser session (GitHub Advisory). For applications that cannot upgrade immediately, the recommended workaround is to disable all resumable partial pipeline steps, including mail_validation and any custom steps decorated with @partial. If those flows are required for business functionality, applications should avoid accepting partial resume links from untrusted contexts until the patch is deployed. There is no complete workaround that preserves the vulnerable partial-pipeline resume mechanism while eliminating the risk (GitHub Advisory).

The vulnerability was responsibly disclosed through GitHub's private vulnerability reporting program by a team of five researchers from the University of Sydney (Liyi Zhou, Ziyue Wang, Strick, Maurice, and Chenchen Yu). Red Hat tracked the issue via Bugzilla (Bug 2540614) and assigned it medium severity. No significant public social media discussion or broader media coverage has been identified at this time (GitHub Advisory, Red Hat Bugzilla).