{"id":"CVE-2024-32879","aliases":["GHSA-2gr8-3wc7-xhj3","PYSEC-2026-1931"],"title":"social-auth-app-django affected by Improper Handling of Case Sensitivity","summary":"social-auth-app-django affected by Improper Handling of Case Sensitivity","severity":"medium","cvss":4.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","vendor":"social-auth-app-django","product":"social-auth-app-django","ecosystem":"pip","affected":["social-auth-app-django < 5.4.1"],"patched":["social-auth-app-django 5.4.1"],"published":"2024-04-24","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:11.181736690Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-2gr8-3wc7-xhj3","references":[{"url":"https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-2gr8-3wc7-xhj3"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32879"},{"url":"https://github.com/python-social-auth/social-app-django/pull/566"},{"url":"https://github.com/python-social-auth/social-app-django/commit/31c3e0c7edb187004d8abbde7e9c4f7ef9098138"},{"url":"https://github.com/python-social-auth/social-app-django"}],"tags":["osv","pip"],"epss":0.00581,"epssPercentile":0.46482,"ingestedAt":"2026-07-08T18:25:44.241Z","slug":"CVE-2024-32879","body":"## Overview\n\n### Impact\nDue to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match.\n\n### Patches\nThis issue has been addressed by https://github.com/python-social-auth/social-app-django/pull/566 and fix released in 5.4.1.\n\n### Workarounds\nAn immediate workaround would be to change collation of the affected field:\n\n```mysql\nALTER TABLE `social_auth_usersocialauth` MODIFY `uid` varchar(255) COLLATE `utf8_bin`;\n```\n\n### References\nThis issue was discovered by folks at https://opencraft.com/.\n\n\n## Affected packages\n\n- `social-auth-app-django < 5.4.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `social-auth-app-django 5.4.1`","depth":"sunlit","depthScore":27,"depthScoreParts":{"impact":27,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}