CVE-2026-57176
Description
A flaw was found in social-auth-core. An identity binding weakness in the Vend OAuth2 authentication backend allows an authenticated remote attacker to gain unauthorized access to another user's account. Because the backend relies solely on numeric user identifiers without scoping them to specific shops, users from different shops sharing identical numeric identifiers can collide in the account association table. An attacker authenticating from one shop can thereby log in to an existing local account associated with another user.
Statement
This vulnerability is rated as Moderate severity for Red Hat products because exploitation requires a specific, non-default configuration where the application explicitly authenticates users across multiple distinct Vend shops. In standard deployments of Red Hat Ansible Automation Platform, the Vend OAuth2 backend is neither configured nor enabled. As a result, typical environments are not exposed to account takeover unless an administrator has manually integrated multiple Vend stores.
Mitigation
Disable the Vend OAuth2 authentication backend or restrict integration to a single Vend shop.
1. To disable the feature, ensure the Vend OAuth2 backend is not included in `SOCIAL_AUTH_AUTHENTICATION_BACKENDS` (or `AUTHENTICATION_BACKENDS`) within the application configuration. In standard Red Hat Ansible Automation Platform installations, this backend is disabled by default.
2. If Vend authentication is required, restrict the application configuration to connect to a single trusted Vend shop.
Caveats:
Removing the backend disables Vend authentication entirely. Restricting to a single store prevents multi-tenant authentication across different shops.
Applying configuration changes requires restarting or reloading the application service for the new settings to take effect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.8 | N/A | 6.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
If unique identifiers are assumed when protecting sensitive resources, then duplicate identifiers might allow attackers to bypass the protection.
Other
Technical Impact: Quality Degradation
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
