CVE-2024-32879

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. This issue has been addressed by a fix released in version 5.4.1. An immediate workaround would be to change collation of the affected field.

• CWE-178
• CWE-303

• https://github.com/python-social-auth/social-app-django/commit/31c3e0c7edb187004d8abbde7e9c4f7ef9098138
• https://github.com/python-social-auth/social-app-django/pull/566
• https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-2gr8-3wc7-xhj3
• https://github.com/python-social-auth/social-app-django/commit/31c3e0c7edb187004d8abbde7e9c4f7ef9098138
• https://github.com/python-social-auth/social-app-django/pull/566
• https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-2gr8-3wc7-xhj3

Published

Apr 24, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-32873Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmo…4.3
• CVE-2024-32874Frigate is a network video recorder (NVR) with realtime loca…6.8
• CVE-2024-32875Hugo is a static site generator. Starting in version 0.123.0…6.1
• CVE-2024-32876NewPipe is an Android app for video streaming written in Jav…8.5
• CVE-2024-32877Yii 2 is a PHP application framework. During internal penetr…4.7
• CVE-2024-32878Llama.cpp is LLM inference in C/C++. There is a use of unini…8.8
• CVE-2024-3288The Logo Slider WordPress plugin before 4.0.0 does not vali…5.4
• CVE-2024-32880pyload is an open-source Download Manager written in pure Py…7.2
• CVE-2024-32881Danswer is the AI Assistant connected to company's docs, app…9.8
• CVE-2024-32882Wagtail is an open source content management system built on…2.7
• CVE-2024-32883MCUboot is a secure bootloader for 32-bits microcontrollers.…7.7
• CVE-2024-32884gitoxide is a pure Rust implementation of Git. `gix-transpor…6.4