CVE-2026-57175
Description
A flaw was found in social-auth-core. The Security Assertion Markup Language (SAML) backend accepts authentication responses without verifying that they correspond to a previously issued authentication request. A remote authenticated attacker with a valid account on a trusted Identity Provider (IdP) can exploit this flaw in applications using SAML account association to link their identity to a logged-in victim's account. This allows the attacker to authenticate through SAML and gain unauthorized access to the victim's account.
Statement
This vulnerability is rated as Moderate impact for Red Hat products because exploitation requires specific non-default conditions, including an active SAML backend configured for account association alongside user interaction with an authenticated session. Additionally, an attacker must already possess valid credentials on a trusted Identity Provider to initiate the account linking process. Deployments not utilizing SAML-based identity linking or where SAML integration is disabled remain unaffected.
Mitigation
Disable the SAML authentication backend if it is not required for your deployment. In Red Hat Ansible Automation Platform, ensure SAML authentication is disabled in Automation Controller settings (under Settings > SAML settings) and rely on alternative authentication mechanisms such as LDAP or local accounts. In custom applications utilizing python-social-auth, remove the SAML backend from `SOCIAL_AUTH_AUTHENTICATION_BACKENDS` or disable SAML account linking for authenticated sessions.
Caveats: Disabling SAML authentication prevents users from authenticating or associating accounts through SAML Identity Providers.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.4 | N/A | 6.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
