Read the docs
TI-2026-34340 Aliases CVE-2026-46715GHSA-97r5-pg8x-p63p

Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance

Priority MEDIUM 57CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim session, they can complete OAuth verification using their own OAuth identity. The victim session is then treated as recently reauthenticated, allowing freshness-protected account actions to proceed. Version 5.8.1 contains a fix for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00352 28th percentileScored 2026-11-07
Fix Fixed Flask-Security-Too (pallets-eco): 5.8.1Flask-Security-Too (PyPI): 5.8.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pallets-ecoFlask-Security-Too5.8.0 to before 5.8.15.8.1Patch availableCNA
—Flask-Security-Too (PyPI)5.8.0 to before 5.8.15.8.1Patch availableGHSA-97r5-pg8x-p63p
  • Flask-Security-Too Vendorpallets-eco Affected 5.8.0 to before 5.8.1 Fixed in 5.8.1 Patch available CNA
  • Flask-Security-Too (PyPI) Vendor— Affected 5.8.0 to before 5.8.1 Fixed in 5.8.1 Patch available GHSA-97r5-pg8x-p63p

Remediation

  • Fix · CNA Flask-Security-Too (pallets-eco) Fixed in 5.8.1
  • Fix · GHSA-97r5-pg8x-p63p Flask-Security-Too (PyPI) Fixed in 5.8.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46715
  2. 2026-10-03 Alias added: GHSA-97r5-pg8x-p63p

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences