Riskcovery

CVE-2024-32879

social-auth-app-django Improper Handling of Case Sensitivity vulnerability

State
Published
Severity
4.9 Medium
Published
Apr 24, 2024
Updated
Aug 2, 2024
Reserved
Apr 19, 2024

Read the record on cve.org

Description

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. This issue has been addressed by a fix released in version 5.4.1. An immediate workaround would be to change collation of the affected field.

Scores

CVSSScoreVectorSource
3.14.9 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:NGitHub_M

Weaknesses

  • CWE-178 Improper Handling of Case Sensitivity
  • CWE-303 Incorrect Implementation of Authentication Algorithm

Affected Products

ProductVersions
social-app-djangopython-social-auth
  • < 5.4.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.