Vendor
The social-auth-core library fails to verify signatures in the vk-app backend when the auth_key parameter is missing, allowing attackers to impersonate arbitrary VK users.