AIKIDO-2026-598511

TL;DR

The partial pipeline resume logic in social_core/utils.py selects the pipeline token before checking whether an external resume needs confirmation. When the request token matches the current session token, the code treats the request as session-owned and resumes immediately, skipping the confirmation step intended for externally resumable partials. As a result, an externally resumable partial link (such as an email validation link) can be consumed by a plain GET in the originating session without the intended confirmation, enabling login CSRF-style consumption of the partial. The fix adds _partial_pipeline_requires_confirmation and reorders token selection so external resumes require explicit confirmation even within the same session.