A flaw was found in social-auth-core. An identity binding weakness in the Vend OAuth2 authentication backend allows an authenticated remote attacker to gain unauthorized access to another user's account. Because the backend relies solely on numeric user identifiers without scoping them to specific shops, users from different shops sharing identical numeric identifiers can collide in the account association table. An attacker authenticating from one shop can thereby log in to an existing local account associated with another user.
Last checked: 2026-09-29 04:06 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-29 02:58 UTC)
Fix evidence last checked: 2026-09-29 17:20 UTC