CVE-2026-34531: Flask-HTTPAuth improper authentication via empty tokens

Executive brief

Flask-HTTPAuth is a library used by web applications to handle user authentication. A vulnerability exists where the library may incorrectly validate empty or missing security tokens. If an application's database stores empty strings for users without tokens, an attacker could potentially log in as those users without providing any credentials, leading to unauthorized account access.

Technical details

Flask-HTTPAuth (up to version 4.8.0) fails to properly handle missing or empty tokens in its token authentication flow. When a client provides an empty token or no token at all, the library invokes the application's token verification callback with an empty string. If the underlying database stores empty strings (rather than NULLs) for users without assigned tokens, the verification may succeed, resulting in an authentication bypass (CWE-287). This issue specifically affects token-based authentication where tokens are looked up in a database; it does not affect cryptographic tokens like JWTs or Basic/Digest authentication. The vulnerability is addressed in version 4.8.1.

Affected products

• miguelgrinberg Flask-HTTPAuth <= 4.8.0

Timeline

• 2026-03-31: advisory: GitHub Advisory GHSA-p44q-vqpr-4xmg published
• 2026-03-31: patched: Version 4.8.1 released

References

• https://api.github.com/users/npbhatter17
• https://github.com/npbhatter17
• https://api.github.com/users/npbhatter17/gists%7B/gist_id%7D
• https://api.github.com/users/npbhatter17/repos
• https://avatars.githubusercontent.com/u/9096408?v=4
• https://api.github.com/users/npbhatter17/events%7B/privacy%7D