CVE-2026-46715

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46715", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-15T23:26:58.309Z", "datePublished": "2026-07-20T17:10:27.014Z", "dateUpdated": "2026-07-20T18:43:54.970Z"}, "containers": {"cna": {"title": "Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/pallets-eco/flask-security/security/advisories/GHSA-97r5-pg8x-p63p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pallets-eco/flask-security/security/advisories/GHSA-97r5-pg8x-p63p"}, {"name": "https://github.com/pallets-eco/flask-security/commit/8e69f3a94a463c0e8ddc46e31743717559fd8d48", "tags": ["x_refsource_MISC"], "url": "https://github.com/pallets-eco/flask-security/commit/8e69f3a94a463c0e8ddc46e31743717559fd8d48"}], "affected": [{"vendor": "pallets-eco", "product": "Flask-Security-Too", "versions": [{"version": ">= 5.8.0, < 5.8.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T17:10:27.014Z"}, "descriptions": [{"lang": "en", "value": "Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim session, they can complete OAuth verification using their own OAuth identity. The victim session is then treated as recently reauthenticated, allowing freshness-protected account actions to proceed. Version 5.8.1 contains a fix for this issue."}], "source": {"advisory": "GHSA-97r5-pg8x-p63p", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/pallets-eco/flask-security/security/advisories/GHSA-97r5-pg8x-p63p", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T18:43:51.952833Z", "id": "CVE-2026-46715", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T18:43:54.970Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46715", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T18:43:51.952833Z"}}}], "references": [{"url": "https://github.com/pallets-eco/flask-security/security/advisories/GHSA-97r5-pg8x-p63p", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T18:43:26.443Z"}}], "cna": {"title": "Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance", "source": {"advisory": "GHSA-97r5-pg8x-p63p", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "pallets-eco", "product": "Flask-Security-Too", "versions": [{"status": "affected", "version": ">= 5.8.0, < 5.8.1"}]}], "references": [{"url": "https://github.com/pallets-eco/flask-security/security/advisories/GHSA-97r5-pg8x-p63p", "name": "https://github.com/pallets-eco/flask-security/security/advisories/GHSA-97r5-pg8x-p63p", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pallets-eco/flask-security/commit/8e69f3a94a463c0e8ddc46e31743717559fd8d48", "name": "https://github.com/pallets-eco/flask-security/commit/8e69f3a94a463c0e8ddc46e31743717559fd8d48", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim session, they can complete OAuth verification using their own OAuth identity. The victim session is then treated as recently reauthenticated, allowing freshness-protected account actions to proceed. Version 5.8.1 contains a fix for this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T17:10:27.014Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46715", "state": "PUBLISHED", "dateUpdated": "2026-07-20T18:43:54.970Z", "dateReserved": "2026-05-15T23:26:58.309Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-20T17:10:27.014Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Flask-Security-Too", "vendor": "pallets-eco", "versions": [{"status": "affected", "version": ">= 5.8.0, < 5.8.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim session, they can complete OAuth verification using their own OAuth identity. The victim session is then treated as recently reauthenticated, allowing freshness-protected account actions to proceed. Version 5.8.1 contains a fix for this issue."}, {"lang": "es", "value": "Flask-Security-Too permite a los usuarios a\u00f1adir caracter\u00edsticas de seguridad a sus aplicaciones Flask. El flujo de reautenticaci\u00f3n OAuth de la versi\u00f3n 5.8.0 puede marcar una sesi\u00f3n como fresca despu\u00e9s de verificar una cuenta OAuth que pertenece a un usuario diferente. Si un atacante puede operar una sesi\u00f3n de v\u00edctima ya autenticada pero obsoleta, puede completar la verificaci\u00f3n OAuth utilizando su propia identidad OAuth. La sesi\u00f3n de la v\u00edctima es entonces tratada como recientemente reautenticada, permitiendo que las acciones de cuenta protegidas por frescura procedan. La versi\u00f3n 5.8.1 contiene una soluci\u00f3n para este problema."}], "id": "CVE-2026-46715", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46715", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T18:43:51.952833Z", "version": "2.0.3"}}]}, "published": "2026-07-20T18:16:52.937", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/pallets-eco/flask-security/commit/8e69f3a94a463c0e8ddc46e31743717559fd8d48"}, {"source": "security-advisories@github.com", "url": "https://github.com/pallets-eco/flask-security/security/advisories/GHSA-97r5-pg8x-p63p"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/pallets-eco/flask-security/security/advisories/GHSA-97r5-pg8x-p63p"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.8.0,5.8.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Flask-Security-Too", "source": "cna", "vendor": "pallets-eco"}, "product": "flask-security-too", "vendor": "pallets-eco"}], "created": "2026-07-21T20:15:02.601374+00:00", "updated": "2026-07-30T19:00:09.758667+00:00", "vendors": ["pallets-eco", "pallets-eco$PRODUCT$flask-security-too"]}