152 matches found
GHSA-97R5-PG8X-P63P Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance
Summary Flask-Security-Too 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim session, they can complete OAuth verification using their own OAuth...
Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance
Flask-Security-Too 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim session, they can complete OAuth verification using their own OAuth identity...
PT-2026-42857
Name of the Vulnerable Software and Affected Versions Flask-Security-Too version 5.8.0 Description An issue in the OAuth reauthentication flow allows a session to be marked as fresh after verifying an OAuth account that belongs to a different user. If an attacker controls an already-authenticated...
CVE-2026-7820 pgAdmin 4: Account-lockout bypass via Flask-Security default /login view
Improper restriction of excessive authentication attempts CWE-307 in pgAdmin 4. pgAdmin enforces MAXLOGINATTEMPTS only inside its custom /authenticate/login view. Flask-Security's default /login view, which is registered automatically by security.initapp and is reachable on every server, never...
OESA-2026-2137 python-flask security update
Flask is a lightweight WSGI web application framework. It is designed to make getting started quick and easy, with the ability to scale up to complex applications. It began as a simple wrapper around Werkzeug and Jinja and has become one of the most popular Python web application frameworks...
CVE-2022-31538
The joaopedro-fg/mp-m08-interface repository through 2020-12-10 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
CVE-2022-31576
The heidi-luong1109/shackerpanel repository through 2021-05-25 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
EUVD-2021-0087
Malware in sbrugna...
EUVD-2022-52996
Malicious code in bioql PyPI...
EUVD-2022-53042
Malicious code in bioql PyPI...
EUVD-2022-53036
Malicious code in bioql PyPI...
EUVD-2022-53007
Malicious code in bioql PyPI...
EUVD-2022-7078
Malicious code in bioql PyPI...
EUVD-2022-52997
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2021-32618
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Python Flask-Security-Too package is used for adding security features to your Flask application. It is an is an independently maintained version of...
CVE-2022-31581
The scorelab/OpenMF repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
CVE-2021-32618
The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is an independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. All versions of Flask-Security-Too allow redirects after many successful views e....
CVE-2025-47278
Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...