CVE-2025-61783

Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses. Version 5.6.0 contains a patch. As a workaround, review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.

• CWE-303

• https://github.com/python-social-auth/social-app-django/commit/10c80e2ebabeccd4e9c84ad0e16e1db74148ed4c
• https://github.com/python-social-auth/social-app-django/issues/220
• https://github.com/python-social-auth/social-app-django/issues/231
• https://github.com/python-social-auth/social-app-django/issues/634
• https://github.com/python-social-auth/social-app-django/pull/803
• https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-wv4w-6qv2-qqfg
• https://github.com/python-social-auth/social-app-django/issues/220
• https://github.com/python-social-auth/social-app-django/issues/231
• https://github.com/python-social-auth/social-app-django/issues/634

Published

Oct 9, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-61777Flag Forge is a Capture The Flag (CTF) platform. Starting in…9.1
• CVE-2025-61778Akka.NET is a .NET port of the Akka project from the Scala /…9.3
• CVE-2025-61779Confidential Containers's Trustee project contains tools and…8.7
• CVE-2025-61780Rack is a modular Ruby web server interface. Prior to versio…5.3
• CVE-2025-61781OpenCTI is an open source platform for managing cyber threat…9.1
• CVE-2025-61782OpenCTI is an open source platform for managing cyber threat…6.1
• CVE-2025-61784LLaMA-Factory is a tuning library for large language models.…8.1
• CVE-2025-61785Deno is a JavaScript, TypeScript, and WebAssembly runtime. I…3.3
• CVE-2025-61786Deno is a JavaScript, TypeScript, and WebAssembly runtime. I…3.3
• CVE-2025-61787Deno is a JavaScript, TypeScript, and WebAssembly runtime. V…8.1
• CVE-2025-61788Opencast is a free, open-source platform to support the mana…5.4
• CVE-2025-61789Icinga DB Web provides a graphical interface for Icinga moni…6.5