Information Disclosure

flask-security-too is vulnerable to information disclosure. The /tf-qrcode endpoint returns the authenticated user's two-factor authentication codes when GET request is submitted. This allows a remote attacker to perform CSRF attacks on a victim to obtain the two-factor authentication codes. The...

PT-2021-24416

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 4.0.0 Description: The issue arises during the setup of two-factor authentication using an authenticator app, where a QR code is generated and made available via a GET request to "/tf-qrcode". Since GET requests do...