Auth bypass in Pallets-eco Flask-security-too
CVE-2026-46715
Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker…
Vulnerability class: Broken Authentication
Affected products
- Pallets-eco Flask-security-too — versions >= 5.8.0, < 5.8.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)