CVE-2026-46715
Received Received - Intake

Flask-Security-Too OAuth Session Freshness Bypass

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim session, they can complete OAuth verification using their own OAuth identity. The victim session is then treated as recently reauthenticated, allowing freshness-protected account actions to proceed. Version 5.8.1 contains a fix for this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-46715
EUVD
EUVD-2026-46039

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
pallets flask-security-too 5.8.0
pallets flask-security-too 5.8.1
flask_security_too flask_security_too 5.8.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Flask-Security-Too version 5.8.0 has a flaw in its OAuth reauthentication process. When a user tries to reauthenticate via OAuth, the system incorrectly marks the session as fresh even if the OAuth account belongs to a different user. This happens because the system does not verify that the OAuth-resolved user matches the currently authenticated session user before updating the session freshness timestamp.

Detection Guidance

Detecting this vulnerability requires checking if your Flask-Security-Too version is 5.8.0. Run: pip show flask-security-too. If version 5.8.0 is installed, the system is vulnerable. Additionally, review OAuth reauthentication logs for mismatched user sessions during OAuth verification.

Impact Analysis

An attacker with access to a victim's stale but authenticated session could complete OAuth verification using their own OAuth identity. This tricks the system into treating the victim's session as recently reauthenticated, allowing the attacker to perform freshness-protected actions like changing the victim's username without proper reauthentication.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized account actions through improper session reauthentication. If an attacker exploits this flaw to perform freshness-protected actions like changing a username or accessing sensitive data, it may constitute a breach of confidentiality or integrity requirements under these regulations.

Mitigation Strategies

Upgrade Flask-Security-Too to version 5.8.1 or later immediately. Run: pip install --upgrade flask-security-too. Ensure OAuth verification callbacks validate that the resolved OAuth user matches the current session user before updating session freshness.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46715. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart