Impact

Due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match.

Patches

This issue has been addressed by python-social-auth/social-app-django#566 and fix released in 5.4.1.

Workarounds

An immediate workaround would be to change collation of the affected field:

ALTER TABLE `social_auth_association` MODIFY `uid` varchar(255) COLLATE `utf8_bin`;

References

This issue was discovered by folks at https://opencraft.com/.

References

• GHSA-2gr8-3wc7-xhj3
• python-social-auth/social-app-django#566
• python-social-auth/social-app-django@31c3e0c
• https://nvd.nist.gov/vuln/detail/CVE-2024-32879