CVE-2025-61783
Description
A flaw was found in Python Social Auth, a social authentication and registration framework. During authentication, a user account could be incorrectly associated by e-mail even when the associate_by_email pipeline was not explicitly enabled. This behavior could allow account takeover if a third-party authentication provider fails to properly validate or enforce uniqueness of e-mail addresses.
Statement
This issue is rated Moderate rather than Important because exploitation depends on multiple external conditions and is limited in scope. The vulnerability does not introduce a direct code execution or privilege escalation vector within Python Social Auth itself; instead, it relies on insecure behavior from third-party identity providers that fail to validate or enforce unique e-mail addresses. In environments where reputable authentication services (e.g., Google, GitHub, Microsoft) are used—each enforcing verified and unique e-mails—the risk is effectively negligible. The flaw becomes exploitable only under misconfigured or untrusted providers, and even then, it merely enables potential account association or takeover rather than full compromise of the underlying application or system.
Mitigation
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
To reduce the risk, administrators should restrict authentication to trusted identity providers that enforce verified and unique e-mail addresses, and ensure that the associate_by_email pipeline is disabled or tightly controlled. Limiting external providers and reviewing account-linking logic can effectively reduce the risk of unintended account association or takeover.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.8 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
