GHSA-x7qq-23vw-7pfg

### Impact The LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victim authenticated as the attacker's LoginRadius identity. The issue affects only applications using the LoginRadius backend. ### Patches The issue has been fixed by enabling callback state validation for the LoginRadius backend. Users should upgrade to a patched version. Fix: * https://github.com/python-social-auth/social-core/pull/1808 ### Workarounds Applications that cannot upgrade immediately should disable the LoginRadius backend by removing it from `SOCIAL_AUTH_AUTHENTICATION_BACKENDS`. There is no complete workaround while continuing to use the vulnerable backend. ### Credits Reported through GitHub private vulnerability reporting by Liyi Zhou, Ziyue Wang, Strick, Maurice, and Chenchen Yu from the University of Sydney security research team. Reporter references: * https://lzhou1110.github.io/ * https://zyy0530.github.io/ * https://str1ckl4nd.github.io/ * https://maurice.busystar.org/ * https://7thparkk.github.io/