Skip to content
OpenAdvisories

Package · PyPI

flask-security-too

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Medium 5.3
    CVE-2026-46715

    Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance

    Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an alre…

    pallets-eco Flask-Security-Too flask-security-too PyPI
  • Medium —
    GHSA-f66q-9rf6-8795

    Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion

    ### Summary Flask-Security-Too 5.8.0 and 5.8.1 mark a session as reauthentication-fresh after processing a WebAuthn assertion whose proven credential belongs to a different user than the currently authenticated session user. The check that `GHSA-97r5-pg8x-p63…

    flask-security-too PyPI
  • Medium 6.1
    CVE-2023-49438 Public exploit Scanner template

    Open redirect vulnerability in Flask-Security-Too

    An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.

    flask-security-too PyPI
  • Low 3.1
    CVE-2021-32618 Scanner template

    Open Redirect Vulnerability

    The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is an independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. All versions of Flask-Security-Too allow re…

    Flask-Middleware flask-security flask-security-too flask-security Ubuntu PyPI
  • Low —
    GHSA-fxq4-r6mr-9x64

    CSRF Vuln can expose user's QRcode

    ### Impact When a user is setting up two-factor authentication using an authenticator app, a QRcode is generated and made available via a GET request to /tf-qrcode. Since GETs do not have any CSRF protection, it is possible a malicious 3rd party could access …

    flask-security-too PyPI
  • High 7.4
    CVE-2021-21241

    CSRF can expose users authentication token in Flask-Security-Too

    The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and…

    Flask-Middleware flask-security-too flask-security-too flask-security Debian PyPI