CVE-2026-34531
Authentication Bypass in Flask-HTTPAuth via Empty Token Handling
Publication date: 2026-04-01
Last updated on: 2026-04-16
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| miguelgrinberg | flask-httpauth | to 4.8.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability in Flask-HTTPAuth could allow unauthorized authentication if an application has users with empty string tokens, potentially leading to unauthorized access to protected resources.
Such unauthorized access could result in exposure or misuse of sensitive personal or health information, which may violate compliance requirements under standards like GDPR or HIPAA that mandate strict access controls and protection of user data.
Therefore, applications affected by this vulnerability might face increased risk of non-compliance with these regulations until they apply the patch in version 4.8.1.
Can you explain this vulnerability to me?
This vulnerability exists in Flask-HTTPAuth versions prior to 4.8.1. When a client requests a token-protected resource without providing a token or provides an empty token, the library calls the application's token verification function with an empty string as the token.
If the application has any users whose token is set to an empty string, the client could be authenticated as one of those users without providing a valid token.
This could allow unauthorized access to protected resources.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to protected resources in an application using Flask-HTTPAuth for token authentication.
Specifically, if any user in the system has an empty string as their token, an attacker can gain access by sending a request with no token or an empty token.
This could result in information disclosure or unauthorized actions performed under the identity of those users.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Flask-HTTPAuth to version 4.8.1 or later, where the issue has been patched.