CVE-2026-62322
Description
A flaw was found in social-auth-core. The LINE authentication backend exchanges authorization codes without validating the returned Open Authorization (OAuth) state parameter. A remote attacker can exploit this flaw by enticing a victim into visiting a crafted callback URL, which can log the victim into an attacker-controlled account or link the attacker's identity to the victim's existing account. This vulnerability can lead to unauthorized account access and account takeover.
Statement
A moderate-severity flaw was found in the Python social-auth-core library, which Red Hat Ansible Automation Platform ships for social and OAuth-based authentication. The LINE authentication backend exchanges OAuth authorization codes without validating the returned state parameter, enabling login cross-site request forgery (CSRF). A remote, unauthenticated attacker can start a LINE authorization flow for an account they control and trick a victim into visiting the resulting crafted callback URL, causing the application to log the victim into the attacker's account; when account linking is enabled, the attacker's LINE identity can instead be linked to the victim's existing account, creating a persistent unauthorized login path and potential account takeover. Only deployments that enable the LINE authentication backend are exposed to this issue. In Red Hat Ansible Automation Platform, the affected components in currently supported streams are resolved as deferred: because the flaw is rated MODERATE severity with a CVSS 3.1 base score below 7.0, no update is currently planned for those streams and the residual risk remains for deployments using LINE login. Affected components in older Ansible Automation Platform streams are out of support scope and will not receive a fix. Red Hat's severity rating (MODERATE, CVSS 3.1 score 6.5) is consistent with the upstream assessment.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Upstream has addressed this flaw in social-auth-core; deploying a product version that includes the upstream fix, once available, is the recommended resolution. Deployments that do not use the LINE authentication backend are not affected.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
