CVE-2026-34531: Improper Authentication

Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token...

aprsd (>=1.6.0, <=3.4.4), aprsd-slack-plugin (>=1.0.5, <=1.2.0) +31 more potentially affected by CVE-2026-34531 via flask-httpauth (>=4.1.0, <=4.8.0)

flask-httpauth PYPI version =4.1.0, =1.6.0, =1.0.5, =0.5.0, =0.0.28, =0.0.0rc24, =1.0.2, =0.2.2, =3.2.0.0, =2.0.0b1, =0.1.8.1, =0.1.0.post3, =0.2.2, =0.1.1, =1.0.2, =1.3.1 and more Source cves: CVE-2026-34531 Source advisory: OSV:GHSA-P44Q-VQPR-4XMG...

yabgp (0.5.0) potentially affected by CVE-2026-34531 via flask-httpauth (2.5.0)

flask-httpauth PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-httpauth and may be impacted: - yabgp 0.5.0 Source cves: CVE-2026-34531 Source advisory: OSV:GHSA-P44Q-VQPR-4XMG...

Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client

Summary In a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any...

GHSA-P44Q-VQPR-4XMG Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client

Summary In a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any...

cloudmesh-client (>=4.5.0, <=4.7.3), python-database-rest-logging (>=1.0.2, <=1.0.5) potentially affected by CVE-2026-34531 via flask-httpauth (3.2.2)

flask-httpauth PYPI version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask-httpauth and may be impacted: - cloudmesh-client =4.5.0, =1.0.2, =1.0.5 Source cves: CVE-2026-34531 Source advisory: OSV:GHSA-P44Q-VQPR-4XMG...

aprsd (>=1.6.0, <=3.4.4), aprsd-slack-plugin (>=1.0.5, <=1.2.0) +31 more potentially affected by CVE-2026-34531 via flask-httpauth (>=4.1.0, <=4.8.0)

flask-httpauth PYPI version =4.1.0, =1.6.0, =1.0.5, =0.5.0, =0.0.28, =0.0.0rc24, =1.0.2, =0.2.2, =3.2.0.0, =2.0.0b1, =0.1.8.1, =0.1.0.post3, =0.2.2, =0.1.1, =1.0.2, =1.3.1 and more Source cves: CVE-2026-34531 Source advisory: GHSA-P44Q-VQPR-4XMG...

cloudmesh-client (>=4.2.6, <=4.4.0) potentially affected by CVE-2026-34531 via flask-httpauth (3.1.2)

flask-httpauth PYPI version 3.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask-httpauth and may be impacted: - cloudmesh-client =4.2.6, =4.4.0 Source cves: CVE-2026-34531 Source advisory: OSV:GHSA-P44Q-VQPR-4XMG...

aprsd (>=1.6.0, <=3.4.4), aprsd-slack-plugin (>=1.0.5, <=1.2.0) +31 more potentially affected by CVE-2026-34531 via flask-httpauth (>=4.1.0, <=4.8.0)

flask-httpauth PYPI version =4.1.0, =1.6.0, =1.0.5, =0.5.0, =0.0.28, =0.0.0rc24, =1.0.2, =0.2.2, =3.2.0.0, =2.0.0b1, =0.1.8.1, =0.1.0.post3, =0.2.2, =0.1.1, =1.0.2, =1.3.1 and more Source cves: CVE-2026-34531 Source advisory: SNYK:PYTHON-FLASKHTTPAUTH-15922817...

airduct (>=0.1.13, <=0.1.22), arctern-server (0.0.4) +4 more potentially affected by CVE-2026-34531 via flask-httpauth (3.3.0)

flask-httpauth PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-httpauth and may be impacted: - airduct =0.1.13, =0.0.5a0, =1.0.0, =2.0.0 - jellyfin-accounts 0.2.0 - python-flask-quick-start 1.1.0 Source cves: CVE-2026-34531...

mapper-interactive (0.0.1), matrix-registration (>=0.5.1.dev0, <=0.7.1) +1 more potentially affected by CVE-2026-34531 via flask-httpauth (3.2.4)

flask-httpauth PYPI version 3.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on flask-httpauth and may be impacted: - mapper-interactive 0.0.1 - matrix-registration =0.5.1.dev0, =1.0.13, =1.0.26 Source cves: CVE-2026-34531 Source advisory:...

PT-2026-29428

Name of the Vulnerable Software and Affected Versions Flask-HTTPAuth versions prior to 4.8.1 Description Flask-HTTPAuth, when used with token authentication, could potentially authenticate client requests against any user in the database with an empty string set as their token if the client reque...

Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client

In a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any users in...