CVE-2026-46715 Details
Description
Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim session, they can complete OAuth verification using their own OAuth identity. The victim session is then treated as recently reauthenticated, allowing freshness-protected account actions to proceed. Version 5.8.1 contains a fix for this issue.
A vulnerability in Flask-Security-Too version 5.8.0 allows an attacker to bypass the OAuth reauthentication freshness requirement. This is achieved by verifying an OAuth account that belongs to a different user, which can mark a session as fresh. If an attacker has access to a stale, already-authenticated victim session, they can use their own OAuth identity to complete the verification. As a result, the victim's session is treated as recently reauthenticated, enabling them to perform actions that require a fresh authentication. This issue has been patched in version 5.8.1.
Users can upgrade to Flask-Security-Too version 5.8.1, which includes a fix for this vulnerability by ensuring that the verified OAuth identity matches the current user before updating the session freshness.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 20, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pallets-eco/flask-security/security/advisories/GHSA-97r5-pg8x-p63p | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/pallets-eco/flask-security/commit/8e69f3a94a463c0e8ddc46e31743717559fd8d48 | [email protected] | Source CodeVendor |
| https://github.com/pallets-eco/flask-security/security/advisories/GHSA-97r5-pg8x-p63p | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Flask-Security-Too | >= 5.8.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |