CVE-2026-34531

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34531", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-30T16:03:31.048Z", "datePublished": "2026-04-01T20:44:10.740Z", "dateUpdated": "2026-05-28T17:14:53.255Z"}, "containers": {"cna": {"title": "Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/miguelgrinberg/Flask-HTTPAuth/security/advisories/GHSA-p44q-vqpr-4xmg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/miguelgrinberg/Flask-HTTPAuth/security/advisories/GHSA-p44q-vqpr-4xmg"}, {"name": "https://github.com/miguelgrinberg/flask-httpauth/commit/b15ffe9e50e110d7174ccd944f642079e1dcf9ee", "tags": ["x_refsource_MISC"], "url": "https://github.com/miguelgrinberg/flask-httpauth/commit/b15ffe9e50e110d7174ccd944f642079e1dcf9ee"}, {"name": "https://github.com/miguelgrinberg/Flask-HTTPAuth/releases/tag/v4.8.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/miguelgrinberg/Flask-HTTPAuth/releases/tag/v4.8.1"}], "affected": [{"vendor": "miguelgrinberg", "product": "Flask-HTTPAuth", "versions": [{"version": "< 4.8.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-01T20:44:10.740Z"}, "descriptions": [{"lang": "en", "value": "Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any users in its database with an empty string set as their token, then it could potentially authenticate the client request against any of those users. This issue has been patched in version 4.8.1."}], "source": {"advisory": "GHSA-p44q-vqpr-4xmg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-02T15:13:05.354180Z", "id": "CVE-2026-34531", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T16:24:04.160Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00049.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-28T17:14:53.255Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00049.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-28T17:14:53.255Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34531", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-02T15:13:05.354180Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T15:13:11.975Z"}}], "cna": {"title": "Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client", "source": {"advisory": "GHSA-p44q-vqpr-4xmg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "miguelgrinberg", "product": "Flask-HTTPAuth", "versions": [{"status": "affected", "version": "< 4.8.1"}]}], "references": [{"url": "https://github.com/miguelgrinberg/Flask-HTTPAuth/security/advisories/GHSA-p44q-vqpr-4xmg", "name": "https://github.com/miguelgrinberg/Flask-HTTPAuth/security/advisories/GHSA-p44q-vqpr-4xmg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/miguelgrinberg/flask-httpauth/commit/b15ffe9e50e110d7174ccd944f642079e1dcf9ee", "name": "https://github.com/miguelgrinberg/flask-httpauth/commit/b15ffe9e50e110d7174ccd944f642079e1dcf9ee", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/miguelgrinberg/Flask-HTTPAuth/releases/tag/v4.8.1", "name": "https://github.com/miguelgrinberg/Flask-HTTPAuth/releases/tag/v4.8.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any users in its database with an empty string set as their token, then it could potentially authenticate the client request against any of those users. This issue has been patched in version 4.8.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-01T20:44:10.740Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34531", "state": "PUBLISHED", "dateUpdated": "2026-05-28T17:14:53.255Z", "dateReserved": "2026-03-30T16:03:31.048Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-01T20:44:10.740Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Flask-HTTPAuth", "vendor": "miguelgrinberg", "versions": [{"status": "affected", "version": "< 4.8.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:miguelgrinberg:flask-httpauth:*:*:*:*:*:python:*:*", "matchCriteriaId": "27C90FDD-EF05-4AF2-BDE6-4E47481562E2", "versionEndExcluding": "4.8.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any users in its database with an empty string set as their token, then it could potentially authenticate the client request against any of those users. This issue has been patched in version 4.8.1."}, {"lang": "es", "value": "Flask-HTTPAuth proporciona autenticaci\u00f3n HTTP Basic, Digest y por Token para rutas de Flask. Antes de la versi\u00f3n 4.8.1, en una situaci\u00f3n donde el cliente realiza una solicitud a un recurso protegido por token sin pasar un token, o pasando un token vac\u00edo, Flask-HTTPAuth invocar\u00eda la funci\u00f3n de callback de verificaci\u00f3n de token de la aplicaci\u00f3n con el argumento del token establecido como una cadena vac\u00eda. Si la aplicaci\u00f3n ten\u00eda usuarios en su base de datos con una cadena vac\u00eda establecida como su token, entonces podr\u00eda potencialmente autenticar la solicitud del cliente contra cualquiera de esos usuarios. Este problema ha sido parcheado en la versi\u00f3n 4.8.1."}], "id": "CVE-2026-34531", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34531", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-02T15:13:05.354180Z", "version": "2.0.3"}}]}, "published": "2026-04-01T21:17:01.147", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/miguelgrinberg/Flask-HTTPAuth/releases/tag/v4.8.1"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/miguelgrinberg/Flask-HTTPAuth/security/advisories/GHSA-p44q-vqpr-4xmg"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/miguelgrinberg/flask-httpauth/commit/b15ffe9e50e110d7174ccd944f642079e1dcf9ee"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00049.html"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.8.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Flask-HTTPAuth", "source": "cna", "vendor": "miguelgrinberg"}, "product": "flask-httpauth", "vendor": "miguelgrinberg"}], "analysis": {"en": {"generated_at": "2026-04-17T09:54:00.350327+00:00", "value": {"mitigation_remediation": ["Update Flask-HTTPAuth to version 4.8.1 or later", "Verify that no user records contain an empty token in the database", "Review and test the token verification logic to ensure it rejects empty tokens and handles missing tokens safely"], "summary": {"action": "Patch Immediately", "impact": "Authentication bypass"}, "threat_synthesis": {"affected_systems": "All installations of the miguelgrinberg:Flask-HTTPAuth package prior to version 4.8.1 are affected. Applications that use this library for Basic, Digest, or Token HTTP authentication and deploy older releases are vulnerable.", "description_and_impact": "Flask-HTTPAuth incorrectly invokes the token verification callback when a request omits a token or supplies an empty string. The callback receives the empty token value, and if the application database contains a user whose token is an empty string, the attacker can be authenticated as that user. This flaw is an authentication failure (CWE\u2011287) that can allow unauthorized access to protected resources, compromising confidentiality and integrity of the application.", "risk_and_exploitability": "The CVSS score of 6.5 indicates medium severity. The EPSS score is less than 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending an unauthenticated HTTP request to a token\u2011protected endpoint. No privileged local access is required, but the ability to authenticate as any user with an empty token presents a significant risk."}}}}, "created": "2026-04-02T07:47:33.142604+00:00", "updated": "2026-04-17T10:00:03.571034+00:00", "vendors": ["miguelgrinberg", "miguelgrinberg$PRODUCT$flask-httpauth"]}