PYSEC-2026-2478 Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance

Summary Flask-Security-Too 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim session, they can complete OAuth verification using their own OAuth...

Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance

Summary Flask-Security-Too 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim session, they can complete OAuth verification using their own OAuth...

PT-2026-59145

Summary Flask-Security-Too 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim session, they can complete OAuth verification using their own OAuth...

GHSA-F66Q-9RF6-8795 Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion

Summary Flask-Security-Too 5.8.0 and 5.8.1 mark a session as reauthentication-fresh after processing a WebAuthn assertion whose proven credential belongs to a different user than the currently authenticated session user. The check that GHSA-97r5-pg8x-p63p added on the OAuth reauthentication path...

Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion

Summary Flask-Security-Too 5.8.0 and 5.8.1 mark a session as reauthentication-fresh after processing a WebAuthn assertion whose proven credential belongs to a different user than the currently authenticated session user. The check that GHSA-97r5-pg8x-p63p added on the OAuth reauthentication path...

Flask-Security vulnerable to Open Redirect

This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only...

PYSEC-2026-809 Flask-Security vulnerable to Open Redirect

This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only...

betterlifepsi (>=0.6.7.post3, <=0.6.8), cg (>=1.0.0b2, <=13.1.0) +21 more potentially affected by CVE-2021-23385 via flask-security (3.0.0)

flask-security PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-security and may be impacted: - betterlifepsi =0.6.7.post3, =1.0.0b2, =0.0.1, =2.5.0, =1.1.2, =1.0.0a2, =1.0.0a23, =0.21.0, =1.0.2, =0.8.3, =0.8.10 and more Source...

invenio-accounts (>=1.0.0a1, <=1.0.0a5), python-database-rest-logging (>=1.0.2, <=1.0.5) potentially affected by CVE-2021-23385 via flask-security (1.7.5)

flask-security PYPI version 1.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on flask-security and may be impacted: - invenio-accounts =1.0.0a1, =1.0.2, =1.0.5 Source cves: CVE-2021-23385 Source advisory: OSV:PYSEC-2026-809...

PT-2026-60911

Summary Flask-Security-Too 5.8.0 and 5.8.1 mark a session as reauthentication-fresh after processing a WebAuthn assertion whose proven credential belongs to a different user than the currently authenticated session user. The check that GHSA-97r5-pg8x-p63p added on the OAuth reauthentication path...

Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion

Flask-Security-Too 5.8.0 and 5.8.1 mark a session as reauthentication-fresh after processing a WebAuthn assertion whose proven credential belongs to a different user than the currently authenticated session user. The check that GHSA-97r5-pg8x-p63p added on the OAuth reauthentication path user.ema...

Open Redirect

Overview Flask-Security is a Simple security for Flask apps. Affected versions of this package are vulnerable to Open Redirect via the validateredirecturl function. An attacker can redirect users to an attacker-controlled domain by crafting a specially formatted URL containing a backslash in the...

Flask-Security has an Open Redirect issue

Open Redirect in Flask-Security Summary flasksecurity.utils.validateredirecturl can allow an attacker-controlled redirect URL when subdomain redirects are enabled. The bypass uses a backslash inside the URL authority/host: text http://evil.com.whitelist.com http://evil.com%5C.whitelist.com...

mxcubeweb (>=4.625.0, <=4.783.0), opentera (>=1.3.0, <=1.3.1) +1 more potentially affected by unknown CVE via flask-security (>=5.5.2, <=5.7.1)

flask-security PYPI version =5.5.2, =4.625.0, =1.3.0, =1.3.1 - spkrepo 0.3.0 Source cves: unknown CVE Source advisory: OSV:GHSA-W2J7-F3C6-G8CW...

GHSA-W2J7-F3C6-G8CW Flask-Security has an Open Redirect issue

Open Redirect in Flask-Security Summary flasksecurity.utils.validateredirecturl can allow an attacker-controlled redirect URL when subdomain redirects are enabled. The bypass uses a backslash inside the URL authority/host: text http://evil.com.whitelist.com http://evil.com%5C.whitelist.com...

mxcubeweb (>=4.625.0, <=4.783.0), opentera (>=1.3.0, <=1.3.1) +1 more potentially affected by CVE-2023-49438 via flask-security (>=5.5.2, <=5.7.1)

flask-security PYPI version =5.5.2, =4.625.0, =1.3.0, =1.3.1 - spkrepo 0.3.0 Source cves: CVE-2023-49438 Source advisory: GHSA-W2J7-F3C6-G8CW...

betterlifepsi (>=0.6.7.post3, <=0.6.8), cg (>=1.0.0b2, <=13.1.0) +21 more potentially affected by unknown CVE via flask-security (3.0.0)

flask-security PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-security and may be impacted: - betterlifepsi =0.6.7.post3, =1.0.0b2, =0.0.1, =2.5.0, =1.1.2, =1.0.0a2, =1.0.0a23, =0.21.0, =1.0.2, =0.8.3, =0.8.10 and more Source...

invenio-accounts (>=1.0.0a1, <=1.0.0a5), python-database-rest-logging (>=1.0.2, <=1.0.5) potentially affected by unknown CVE via flask-security (1.7.5)

flask-security PYPI version 1.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on flask-security and may be impacted: - invenio-accounts =1.0.0a1, =1.0.2, =1.0.5 Source cves: unknown CVE Source advisory: OSV:GHSA-W2J7-F3C6-G8CW...

mxcubeweb (>=4.625.0, <=4.783.0), opentera (>=1.3.0, <=1.3.1) +1 more potentially affected by unknown CVE via flask-security (>=5.5.2, <=5.7.1)

flask-security PYPI version =5.5.2, =4.625.0, =1.3.0, =1.3.1 - spkrepo 0.3.0 Source cves: unknown CVE Source advisory: SNYK:PYTHON-FLASKSECURITY-17670533...

Flask-Security has an Open Redirect issue

flasksecurity.utils.validateredirecturl can allow an attacker-controlled redirect URL when subdomain redirects are enabled. The bypass uses a backslash inside the URL authority/host: text http://evil.com.whitelist.com http://evil.com%5C.whitelist.com Python's urlsplit parses the full authority as...