Authentication Bypass in social-auth-core VK App Backend

A vulnerability (CVE-2026-57178) exists in the social-auth-core library affecting the vk-app backend. When an application processes callback data from the VK platform, the library fails to enforce signature verification if the auth_key parameter is omitted from the request. This flaw allows an attacker to manipulate callback parameters such as viewer_id, access_token, api_id, and api_result. By crafting a malicious request without an auth_key, an attacker can inject arbitrary identity information, tricking the backend into authenticating them as any VK user. This vulnerability is specific to the social_core.backends.vk.VKAppOAuth2 implementation. Defending against this requires upgrading to version 5.0.0 or later, or disabling the affected authentication backend entirely.

Impact

Successful exploitation allows for full authentication bypass and identity impersonation within any web application that relies on the vk-app backend for user login. An attacker can gain unauthorized access to victim accounts, access user-specific data, and perform actions on behalf of legitimate users. The vulnerability affects all users of social-auth-core versions prior to 5.0.0 utilizing the VK App OAuth2 backend.

Recommendation

• Upgrade social-auth-core to version 5.0.0 or later to ensure the auth_key parameter is strictly required for signature verification.
• If an immediate upgrade is not feasible, disable the vulnerable backend by removing social_core.backends.vk.VKAppOAuth2 from the SOCIAL_AUTH_AUTHENTICATION_BACKENDS configuration in your application settings.