CVE-2026-34531

HIGH EPSS 24.2%
Published Apr 1, 20263mo ago · Modified Jun 17, 20262w ago
8.2 CVSS 3.1
High
Find Similar
Published Apr 1, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any users in its database with an empty string set as their token, then it could potentially authenticate the client request against any of those users. This issue has been patched in version 4.8.1.

CVSS Details

Base Score
8.2
Exploitability
3.9
Impact
4.2
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
24.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-287 Improper Authentication Authentication

Affected Products 1

VendorProductVersionRange
miguelgrinbergflask-httpauth* <4.8.1

References 4

  • github.com https://github.com/miguelgrinberg/Flask-HTTPAuth/releases/tag/v4.8.1
    ProductRelease Notes
  • github.com https://github.com/miguelgrinberg/Flask-HTTPAuth/security/advisories/GHSA-p44q-vqpr-4xmg
    MitigationVendor Advisory
  • github.com https://github.com/miguelgrinberg/flask-httpauth/commit/b15ffe9e50e110d7174ccd944f642079e1dcf9ee
    Patch
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2026/05/msg00049.html

Remediation

  • github.com https://github.com/miguelgrinberg/flask-httpauth/commit/b15ffe9e50e110d7174ccd944f642079e1dcf9ee
    Patch