CVE-2024-32879

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. This issue has been addressed by a fix released in version 5.4.1. An immediate workaround would be to change collation of the affected field.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-178 CWE-303

Affected software

Vendor	Product	Versions
python-social-auth	social-app-django	< 5.4.1
python-social-auth	social-app-django	< 5.4.1

References

Timeline

Published: Apr 24, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-32885.4The Logo Slider WordPress plugin before 4.0.0 does not validate and escape some of its Slider Settings before outputting them back in attri CVE-2024-328807.2pyload is an open-source Download Manager written in pure Python. An authenticated user can change the download folder and upload a crafted CVE-2024-328819.8Danswer is the AI Assistant connected to company's docs, apps, and people. Danswer is vulnerable to unauthorized access to GET/SET of Slack CVE-2024-328822.7Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing thr CVE-2024-328837.7MCUboot is a secure bootloader for 32-bits microcontrollers. MCUboot uses a TLV (tag-length-value) structure to represent the meta data asso CVE-2024-328846.4gitoxide is a pure Rust implementation of Git. `gix-transport` does not check the username part of a URL for text that the external `ssh` pr CVE-2024-328864.9Vitess is a database clustering system for horizontal scaling of MySQL. When executing the following simple query, the `vtgate` will go into CVE-2024-328875.5Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflec CVE-2024-3288810.0The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application progra CVE-2024-32897.8When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior to 10.7.3 did not enforce sec CVE-2024-328906.1librespeed/speedtest is an open source, self-hosted speed test for HTML5. In affected versions missing neutralization of the ISP information CVE-2024-328917.0In sec_media_unprotect of media.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of pri