CVE-2026-62322: 
Python vulnerability analysis and mitigation

CVE-2026-62322 is a Login CSRF / forced authentication vulnerability in the LINE backend (LineOAuth2) of Python Social Auth's social-core package, caused by missing OAuth state parameter validation. All versions of social-auth-core prior to 5.0.2 are affected; the issue is described as an incomplete fix of a prior 5.0.0 security campaign. It was originally reported by Ta Duc Thien and Duc Anh Nguyen, published to the GitHub Advisory Database on June 30, 2026, and assigned a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, Feedly). Only applications with the LINE backend enabled are affected.

The root cause is that the LineOAuth2 backend's auth_complete() method exchanged an authorization code with LINE's OAuth endpoint without first calling validate_state() to verify the returned state parameter, violating the OAuth 2.0 CSRF protection mechanism (CWE-352; also classified as CWE-358 — Improperly Implemented Security Check for Standard) (Github Advisory). An attacker initiates a legitimate LINE authorization flow for an account they control, captures the resulting callback URL (containing their authorization code), and tricks a victim into visiting that URL — for example via a phishing link or injected redirect. Because the state is not validated, the application accepts the forged callback and authenticates the victim as the attacker's LINE account. The fix, merged in PR #1829, adds a single self.validate_state() call in auth_complete() before the access token exchange (Patch PR, Patch Commit).

Successful exploitation allows an unauthenticated attacker to force a victim's browser session to be authenticated as the attacker's LINE account (login CSRF / forced authentication), with high integrity impact and no direct confidentiality or availability loss (Github Advisory). When account linking is enabled, the attacker can additionally link their LINE identity to the victim's existing application account, establishing a persistent unauthorized login path that survives password changes. This could enable ongoing unauthorized access to the victim's account and any data or actions accessible through it (Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is 0.0, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Exploitation requires user interaction (the victim must visit the attacker-crafted callback URL) but requires no privileges from the attacker, making social engineering the primary attack vector. No threat actor attribution has been reported.

1. Reconnaissance: Identify a target web application using python-social-auth (social-auth-core < 5.0.2) with the LINE Login backend (LineOAuth2) enabled.
2. Initiate attacker-controlled OAuth flow: The attacker registers or uses their own LINE account and begins the LINE OAuth authorization flow on the target application, obtaining a valid authorization code and callback URL tied to their LINE account.
3. Capture the callback URL: Record the full callback URL generated by LINE for the attacker's authorization code (e.g., https://target.example.com/complete/line/?code=ATTACKER_CODE&state=SOME_STATE).
4. Deliver the malicious URL to the victim: Trick the victim into visiting the attacker's callback URL via phishing, a malicious link, or an open redirect — while the victim may or may not be logged into the application.
5. Exploit missing state validation: Because the LINE backend does not call validate_state(), the application accepts the callback without verifying the state parameter, exchanges the attacker's authorization code for a token, and logs the victim in as the attacker's LINE account.
6. Account linking (optional escalation): If the application has account linking enabled and the victim is already authenticated, the same forged callback links the attacker's LINE identity to the victim's existing account, granting the attacker persistent login access (Github Advisory, Patch PR).

• Logs: Application authentication logs showing a user session authenticated via the LINE backend immediately after the user visited an externally-sourced or unexpected callback URL; multiple LINE OAuth callback requests from different IP addresses for the same authorization code.
• Network: Unexpected or externally-referred HTTP requests to the LINE OAuth callback endpoint (e.g., /complete/line/) with code and state parameters not originating from the user's own browser session flow.
• Application Behavior: Users reporting being logged into an unfamiliar account after clicking a link; unexpected LINE account associations appearing in account linking records for existing users.

Upgrade social-auth-core to version 5.0.2 or later, which adds self.validate_state() in the LINE backend's auth_complete() method before the authorization code exchange (Release 5.0.2, Github Advisory). If immediate patching is not possible, disable the LINE backend entirely or disable account linking functionality to reduce the attack surface. Application-level controls that enforce strict referrer or origin checking on OAuth callbacks may provide partial mitigation but are not a substitute for patching (Feedly).

The vulnerability was responsibly disclosed by researchers Ta Duc Thien and Duc Anh Nguyen via GitHub, and the fix was developed and merged by project maintainer nijel (Github Advisory). No significant broader media coverage or notable public researcher commentary beyond the advisory and patch discussion has been identified.