Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Upon authentication, the user could be associated by e-mail even if the associatebyemail pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses. Patches https://github.com/python-social-auth/social-app-django/pull/803 Workarounds Review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.
Recommended action: Upgrade to 5.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. Patches This issue has been addressed by https://github.com/python-social-auth/social-app-django/pull/566 and fix released in 5.4.1. Workarounds An immediate workaround would be to change collation of the affected field: References This issue was discovered by folks at https://opencraft.com/.
Recommended action: Upgrade to 5.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.