ETK-2026-1266Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-1266",
  "cve_id": null,
  "display_id": "ETK-2026-1266",
  "ghsa_id": "GHSA-m4mf-rqrp-5pq8",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Cross-account authentication in social-auth-core OAuth backends",
  "summary": "social-auth-core versions affected by this issue can incorrectly associate HubSpot, Monzo, or WLCG sign-ins with another local account. An attacker using an affected enabled backend may be authenticated as the account associated with an earlier login when the application has stored the shared malformed identifier. This requires the affected provider backend to be enabled and a prior association to exist.",
  "mitigation": "Upgrade social-auth-core to 6.1.1 or later. Review and remove or repair affected provider associations that use the malformed shared identifier, and investigate accounts authenticated through these backends.",
  "vendor": "pip",
  "product": "pip:social-auth-core",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.5.4, <= 6.1.0"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "6.1.1"
      ],
      "package_name": "social-auth-core",
      "purl": "pkg:pypi/social-auth-core"
    }
  ],
  "cwes": [
    287
  ],
  "cvss_score": 7,
  "cvss_src": "ethiack_provisional",
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 13.52975095,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-10T07:42:49+00:00",
      "days": -10.881013278935185,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T04:51:28.571997+00:00",
      "url": "https://github.com/python-social-auth/social-core/security/advisories/GHSA-m4mf-rqrp-5pq8"
    }
  }
}