Package
awx
Component
social-auth-core
Latest update
Fixed version
24.6.1-r70
6.4
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
24.6.1-r70Status
Impact
This issue is fixed only in social-auth-core 5.0.0. AWX 24.6.1 pins social-auth-core 4.4.2 and is incompatible with 4.8 or later: the SAMLIdentityProvider constructor signature changed and AWX's SAML backend calls it with the old signature, which breaks SAML login entirely. Upstream AWX has removed its SSO application from the development branch and will not ship a 24.6.1-compatible release, so the dependency cannot be bumped without breaking SAML authentication. Deployments that do not configure a SAML identity provider (SOCIAL_AUTH_SAML_ENABLED_IDPS, empty by default) are not affected.
Status
Fixed version
24.6.1-r70Status
Impact
This issue is fixed only in social-auth-core 5.0.0. AWX 24.6.1 pins social-auth-core 4.4.2 and is incompatible with 4.8 or later: the SAMLIdentityProvider constructor signature changed and AWX's SAML backend calls it with the old signature, which breaks SAML login entirely. Upstream AWX has removed its SSO application from the development branch and will not ship a 24.6.1-compatible release, so the dependency cannot be bumped without breaking SAML authentication. Deployments that do not configure a SAML identity provider (SOCIAL_AUTH_SAML_ENABLED_IDPS, empty by default) are not affected.
Status
Fixed version
24.6.1-r59Status