USN-7534-1 flask vulnerability

It was discovered that Flask incorrectly handled key rotation. An attacker could possibly use this issue to sign sessions with stale keys...

CVE-2025-47278

A flaw was found in Flask. This vulnerability allows sessions to be signed with stale keys via incorrect fallback key configuration...

CVE-2025-47278

Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...