Skip to content
OpenAdvisories
Low USN-7534-1 1 CVE

flask vulnerability

Published May 26, 2025 · Updated Oct 13, 2025

Ecosystem: Ubuntu

Summary

It was discovered that Flask incorrectly handled key rotation.
An attacker could possibly use this issue to sign sessions
with stale keys.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 25.04 flask 3.1.0-2ubuntu1.1

Vulnerabilities 1

  • Low 1.8
    CVE-2025-47278

    Flask uses fallback key instead of current signing key

    Flask is a web server gateway interface (WSGI) web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the …

    pallets flask airflow-3 emissary Debian Azure Linux Wolfi PyPI

References

  • report
    https://ubuntu.com/security/CVE-2025-47278