CVE-2026-46715

A flaw was found in Flask-Security-Too. The OAuth reauthentication process in the affected component can incorrectly mark a user's session as recently reauthenticated after an attacker verifies their own OAuth account within an already authenticated but stale victim session. This allows an attack...

Wrong parameter in _removeTokenFrom call from _burn internal function

Lines of code Vulnerability details Impact Break the posibility of third party callapprove or approvalForAll authorization to withdraw and merge functions what use the burn internal function Proof of Concept If somebody use the withdraw or merge functions as third party "operator" with approve or...