Showing 6 vulnerabilities on this page for Flask-Security-Too

Signals CISA KEV Ransomware Nuclei
PyPI vulnerability results
VulnerabilityTitle and contextCVSSEPSSPoCsSignalsSTIX action

Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance

Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim session, they can complete OAuth verification using their own OAuth identity. The victim session is then treated as recently reauthenticated, allowing freshness-protected account actions to proceed. Version

CWE-287Jul 20, 2026
CVSS5.3v4.0EPSS0.279%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion

### Summary Flask-Security-Too 5.8.0 and 5.8.1 mark a session as reauthentication-fresh after processing a WebAuthn assertion whose proven credential belongs to a different user than the currently authenticated session user. The check that `GHSA-97r5-pg8x-p63p` added on the OAuth reauthentication path (`user.email == current_user.email`) is missing on the WebAuthn reauthentication path. An attacker who owns any WebAuthn credential registered to any account on the deployment can satisfy a victim

CWE-287CWE-863Jul 7, 2026
CVSS-v4.0EPSS-PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Open redirect vulnerability in Flask-Security-Too

An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.

CWE-601Dec 26, 20231 related artifact
CVSS-v4.0EPSS1.08%PoCs1SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei templateSTIX

Open Redirect Vulnerability

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is an independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. All versions of Flask-Security-Too allow redirects after many successful views (e.g. /login) by honoring the ?next query param. There is code in FS to validate that the url specified in the next parameter is either relative OR has the same netloc (network location) as the requesting

CWE-601May 17, 20211 related artifact
CVSS-v4.0EPSS3.29%PoCs0SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei templateSTIX

CSRF Vuln can expose user's QRcode

### Impact When a user is setting up two-factor authentication using an authenticator app, a QRcode is generated and made available via a GET request to /tf-qrcode. Since GETs do not have any CSRF protection, it is possible a malicious 3rd party could access the QRcode and therefore gain access to two-factor authentication codes. Note that the /tf-qrcode endpoint is ONLY accessible while the user is initially setting up their device. Once setup is complete, there is no vulnerability. ### Patche

CWE-352Apr 8, 2021
CVSS-EPSS-PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

CSRF can expose users authentication token in Flask-Security-Too

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party si

CWE-352Jan 11, 2021
CVSS-v4.0EPSS0.917%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX