CVE-2026-34531

CVE-2026-34531 affects Flask-HTTPAuth (Python package) and concerns the token verification callback receiving an empty string when a request targets a token-protected resource without a token or with an empty token. This could allow authentication against any user whose token is an empty string. ...

CVE-2026-34531 Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client

Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token...

CVE-2026-34531

Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token...

CVE-2026-34531

Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token...

CVE-2026-34531 Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client

Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by multiple vulnerabilities due to Flask-Cors

Summary Flask-Cors is used by IBM Cloud Pak for Data System to handle Cross-Origin Resource Sharing CORS for web applications. Multiple vulnerabilities affect Flask-Cors path matching functionality. CVE-2024-6866 involves case-insensitive path matching that can allow unauthorized origins to acces...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - IoT Component uses assertj-core-3.27.6.jar, minimatch-3.1.2.tgz, flask-3.1.2-py3-none-any.whl and werkzeug-3.1.5-py3-none-any.whl third party dependencies which is vulnerable to CVE-2026-24400, CVE-2026-26996, CVE-2026-27205 and CVE-2026-27199. This bulletin...

CVE-2026-34531: Improper Authentication

Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token...

Flask-HTTPAuth Authorization Issue Vulnerability

Flask-HTTPAuth is an HTTP authentication extension for the Flask framework developed by Miguel Grinberg. Versions of Flask-HTTPAuth prior to 4.8.1 had an authorization vulnerability. This vulnerability occurred when the client made a request to a resource protected by a token, but did not pass th...

mapper-interactive (0.0.1), matrix-registration (>=0.5.1.dev0, <=0.7.1) +1 more potentially affected by CVE-2026-34531 via flask-httpauth (3.2.4)

flask-httpauth PYPI version 3.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on flask-httpauth and may be impacted: - mapper-interactive 0.0.1 - matrix-registration =0.5.1.dev0, =1.0.13, =1.0.26 Source cves: CVE-2026-34531 Source advisory:...

aprsd (>=1.6.0, <=3.4.4), aprsd-slack-plugin (>=1.0.5, <=1.2.0) +31 more potentially affected by CVE-2026-34531 via flask-httpauth (>=4.1.0, <=4.8.0)

flask-httpauth PYPI version =4.1.0, =1.6.0, =1.0.5, =0.5.0, =0.0.28, =0.0.0rc24, =1.0.2, =0.2.2, =3.2.0.0, =2.0.0b1, =0.1.8.1, =0.1.0.post3, =0.2.2, =0.1.1, =1.0.2, =1.3.1 and more Source cves: CVE-2026-34531 Source advisory: SNYK:PYTHON-FLASKHTTPAUTH-15922817...

aprsd (>=1.6.0, <=3.4.4), aprsd-slack-plugin (>=1.0.5, <=1.2.0) +31 more potentially affected by CVE-2026-34531 via flask-httpauth (>=4.1.0, <=4.8.0)

flask-httpauth PYPI version =4.1.0, =1.6.0, =1.0.5, =0.5.0, =0.0.28, =0.0.0rc24, =1.0.2, =0.2.2, =3.2.0.0, =2.0.0b1, =0.1.8.1, =0.1.0.post3, =0.2.2, =0.1.1, =1.0.2, =1.3.1 and more Source cves: CVE-2026-34531 Source advisory: OSV:GHSA-P44Q-VQPR-4XMG...

aprsd (>=1.6.0, <=3.4.4), aprsd-slack-plugin (>=1.0.5, <=1.2.0) +31 more potentially affected by CVE-2026-34531 via flask-httpauth (>=4.1.0, <=4.8.0)

flask-httpauth PYPI version =4.1.0, =1.6.0, =1.0.5, =0.5.0, =0.0.28, =0.0.0rc24, =1.0.2, =0.2.2, =3.2.0.0, =2.0.0b1, =0.1.8.1, =0.1.0.post3, =0.2.2, =0.1.1, =1.0.2, =1.3.1 and more Source cves: CVE-2026-34531 Source advisory: GHSA-P44Q-VQPR-4XMG...

airduct (>=0.1.13, <=0.1.22), arctern-server (0.0.4) +4 more potentially affected by CVE-2026-34531 via flask-httpauth (3.3.0)

flask-httpauth PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-httpauth and may be impacted: - airduct =0.1.13, =0.0.5a0, =1.0.0, =2.0.0 - jellyfin-accounts 0.2.0 - python-flask-quick-start 1.1.0 Source cves: CVE-2026-34531...

cloudmesh-client (>=4.5.0, <=4.7.3), python-database-rest-logging (>=1.0.2, <=1.0.5) potentially affected by CVE-2026-34531 via flask-httpauth (3.2.2)

flask-httpauth PYPI version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask-httpauth and may be impacted: - cloudmesh-client =4.5.0, =1.0.2, =1.0.5 Source cves: CVE-2026-34531 Source advisory: OSV:GHSA-P44Q-VQPR-4XMG...

cloudmesh-client (>=4.2.6, <=4.4.0) potentially affected by CVE-2026-34531 via flask-httpauth (3.1.2)

flask-httpauth PYPI version 3.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask-httpauth and may be impacted: - cloudmesh-client =4.2.6, =4.4.0 Source cves: CVE-2026-34531 Source advisory: OSV:GHSA-P44Q-VQPR-4XMG...

yabgp (0.5.0) potentially affected by CVE-2026-34531 via flask-httpauth (2.5.0)

flask-httpauth PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-httpauth and may be impacted: - yabgp 0.5.0 Source cves: CVE-2026-34531 Source advisory: OSV:GHSA-P44Q-VQPR-4XMG...

Improper Authentication

Overview Flask-HTTPAuth is a HTTP authentication for Flask routes Affected versions of this package are vulnerable to Improper Authentication in the token verification process. An attacker can gain unauthorized access by submitting a request with a missing or empty token if the application stores...

Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client

Summary In a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any...

GHSA-P44Q-VQPR-4XMG Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client

Summary In a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any...