CVE-2024-32879: social-auth-app-django Improper Handling of Case Sensitivity vulnerability
Vulnerability summary
CVE-2024-32879 is a medium (CVSS 4.9) Improper Handling of Case Sensitivity vulnerability in python-social-auth social-app-django. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 47.8% of scored vulnerabilities.
Not severe (CVSS 4.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2Timeline
- 24-04-2024PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. This issue has been addressed by a fix released in version 5.4.1. An immediate workaround would be to change collation of the affected field.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · PypiEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
- NVDNIST4.9MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.58%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.58% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-178Improper Handling of Case SensitivityThe product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
- CWE-303Incorrect Implementation of Authentication AlgorithmThe requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- social-auth-app-djangoAll versions (No fix recorded) | < 5.4.1-1
Opensuse1 product
- python-social-auth-app-django&distro=openSUSE Tumbleweed< 5.4.1-1.1 | < 5.9.0-1.2
PyPI1 product
- social-auth-app-django< 5.4.1
Python-social-auth1 product
- social-app-django< 5.4.1
Ubuntu1 product
- python-social-authAll versions (No fix recorded)
5 vendors · 5 products
References
11 links- github.com/python-social-auth/social-app-django/security/advisories/GHSA-2gr8-3wc7-xhj3X Refsource CONFIRMWEBREPORT
- github.com/python-social-auth/social-app-django/commit/31c3e0c7edb187004d8abbde7e9c4f7ef9098138X Refsource MISCWEBREPORT
