CVE-2026-115910 | python-social-auth up to 6.1.x OpenIdConnectAuth open_id_connect.py get_and_store_nonce improper authorization

October 26, 2026 Yanac

A vulnerability was found in python-social-auth up to 6.1.x. It has been rated as critical. This impacts the function get_and_store_nonce of the file social_core/backends/open_id_connect.py of the component OpenIdConnectAuth. The manipulation of the argument nonce leads to improper authorization.

This vulnerability is referenced as CVE-2026-115910. Remote exploitation of the attack is possible. No exploit is available.

Upgrading the affected component is advised.VulDB Recent EntriesRead More