| Package | Affected versions | Patched versions |
|---|---|---|
| social-auth-core | < 5.0.2 | 5.0.2 |
Applications using the LINE Login backend are vulnerable to login CSRF / forced authentication. An attacker can start a LINE authorization flow for an account they control and trick a victim into visiting the callback URL with the attacker’s authorization code. Because the LINE backend did not validate the returned OAuth state, the application could accept the forged callback and log the victim in as the attacker-controlled LINE account.
If account linking is enabled, the same flaw can allow an attacker to link their LINE identity to a victim’s existing authenticated account, creating a persistent unauthorized login path.
Only applications that enable the LINE backend are affected.
Thanks to Ta Duc Thien and Duc Anh Nguyen for reproting this via GitHub.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free