GHSA-x7qq-23vw-7pfg

### Impact

The LoginRadius backend did not validate OAuth state during the authentication flow.

Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victim authenticated as the attacker's LoginRadius identity.

The issue affects only applications using the LoginRadius backend.

### Patches

The issue has been fixed by enabling callback state validation for the LoginRadius backend.

Users should upgrade to a patched version.

Fix:

* https://github.com/python-social-auth/social-core/pull/1808

### Workarounds

Applications that cannot upgrade immediately should disable the LoginRadius backend by removing it from `SOCIAL_AUTH_AUTHENTICATION_BACKENDS`.

There is no complete workaround while continuing to use the vulnerable backend.

### Credits

Reported through GitHub private vulnerability reporting by Liyi Zhou, Ziyue Wang, Strick, Maurice, and Chenchen Yu from the University of Sydney security research team.

Reporter references:

* https://lzhou1110.github.io/ * https://zyy0530.github.io/ * https://str1ckl4nd.github.io/ * https://maurice.busystar.org/ * https://7thparkk.github.io/