CVE-2026-46715

Summary of CVE-2026-46715 (Flask-Security-Too) Affected: Flask-Security-Too up to version 5.8.0. Issue: in the OAuth reauthentication flow, the verification callback can mark a victim’s session as freshly reauthenticated after an OAuth identity belonging to a different user is verified. If an att...

CVE-2026-46715 Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance

Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim...

CVE-2026-46715

Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim...

CVE-2026-46715 Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance

Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim...

EUVD-2026-46039

Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim...

CVE-2026-46715 Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance

Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim...

ROOT-APP-PYPI-CVE-2024-6221 CVE-2024-6221 in rootio-flask-cors - Patched by Root

Root has patched CVE-2024-6221 in the rootio-flask-cors package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-6866 CVE-2024-6866 in rootio-flask-cors - Patched by Root

Root has patched CVE-2024-6866 in the rootio-flask-cors package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-27205 CVE-2026-27205 in rootio-Flask - Patched by Root

Root has patched CVE-2026-27205 in the rootio-Flask package for Root:PyPI. Multiple fixed versions available...

CVE-2026-54567

creationtimestamp| type| source ---|---|--- 2026-07-17 22:35:08+00:00| published-proof-of-concept| https://github.com/jugmac00/flask-reuploaded/security/advisories/GHSA-937x-gpqr-72gg...

GHSA-937X-GPQR-72GG Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

Header | Field | Value | |---|---| | Title | Extension-denylist bypass via case-folding asymmetry in name-override path incomplete-fix variant of CVE-2026-27641 | | Project | Flask-Reuploaded flaskuploads | | Affected | extension"shell.php" = "php" - extensionallowed"php" - DENY correct...

Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

Header | Field | Value | |---|---| | Title | Extension-denylist bypass via case-folding asymmetry in name-override path incomplete-fix variant of CVE-2026-27641 | | Project | Flask-Reuploaded flaskuploads | | Affected | extension"shell.php" = "php" - extensionallowed"php" - DENY correct...

PT-2026-60901

Name of the Vulnerable Software and Affected Versions Flask-Reuploaded versions prior to 1.5.1 Description An issue exists in the UploadSet.save function where the name parameter can be used to bypass extension denylists. When a user provides a name override, the system performs re-validation usi...

CVE-2026-45336 HireFlow: Use of Hard-coded Credentials

HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring progress. In 1.2 and earlier, app.py assigns a hard-coded Flask secretkey used to sign session cookies, allowing unauthenticated attackers who know the public source value to...

Exploit for Improper Input Validation in Pyyaml

Seal Security — Python pip Example A minimal, intentionally...

PYSEC-2026-2588 Lemur has an authorization bypass in StrictRolePermission / AuthorityCreatorPermission

Summary StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flaskprincipal.Permission.init with zero Needs when their config flags are unset. Both flags defaulted to False in code prior to the fix, so this was the state of any Lemur install that hadn't explicitly...

Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance

Summary Flask-Security-Too 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim session, they can complete OAuth verification using their own OAuth...

PYSEC-2026-2478 Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance

Summary Flask-Security-Too 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim session, they can complete OAuth verification using their own OAuth...

PYSEC-2026-2998 pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad

Summary The fix for CVE-2026-33509 prevents setting storagefolder inside PKGDIR or userdir, but does NOT protect the Flask session directory /tmp/pyLoad/flask. An authenticated attacker can set storagefolder to the session directory and download session files of other users via /files/get/, leadi...

PYSEC-2026-2904 PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution

Summary PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token. Details The vulnerable server is the shippe...