Executive brief
Flask uses fallback key instead of current signing key
Affected products
- PyPI flask
Junglewise Threat Intelligence
CVE-2025-47278: PYSEC-2026-1377 - Flask uses fallback key instead of current signing key
CVE-2025-47278 · Severity: medium · CVSS 4 · Published 2026-07-07
Technologies: flask (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-2151 - Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed
- PYSEC-2023-62 - Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for
- PYSEC-2019-179 - The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafte
- PYSEC-2018-66 - The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large