CVE-2026-46715: Pallets-Eco Flask-Security-Too OAuth reauthentication freshness bypass

CVE-2026-46715 · Severity: medium · CVSS 0 · Published 2026-07-20

Flask-Security-Too is a library used to add security and authentication features to Flask web applications. A flaw in its OAuth reauthentication process allows an attacker who has access to a user's expired or 'stale' session to refresh that session's security status using their own social media or OAuth account. This could allow an unauthorized person to perform sensitive actions, such as changing a victim's username or account settings, without knowing the victim's actual credentials.

Technologies: Flask-Security-Too (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-46715 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46715 being exploited in the wild.
How severe is CVE-2026-46715?
Medium severity, with a CVSS score of 0, published 20 July 2026.
Which products and versions are affected?
Flask-Security-Too (PyPI) >= 5.8.0, < 5.8.1, ECOSYSTEM:introduced=5.8.0,fixed=5.8.1.
Is there a fix for CVE-2026-46715?
Yes. Flask-Security-Too (PyPI): upgrade to 5.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46715 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-46715?
Check whether you run Flask-Security-Too (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Flask-Security-Too (PyPI): upgrade to 5.8.1 or later
    pip install "Flask-Security-Too>=5.8.1"

Technical details

An improper authentication vulnerability exists in Flask-Security-Too version 5.8.0 within the OAuth reauthentication flow. The `oauth_verify_response()` function in `flask_security/oauth_glue.py` fails to verify that the user identity returned by the OAuth provider matches the currently authenticated `current_user`. If an attacker can operate a stale but still authenticated victim session, they can complete the OAuth verification process using their own OAuth credentials. This updates the session's freshness timestamp (`fs_paa`), allowing the attacker to bypass 'freshness' requirements for sensitive routes like `/change-username`. The issue is resolved in version 5.8.1 by ensuring the OAuth-resolved email matches the session user.

Affected products

  • pallets-eco Flask-Security-Too >= 5.8.0, < 5.8.1

Identifiers

  • CVE-2026-46715
  • GHSA-97r5-pg8x-p63p
  • PYSEC-2026-2478

Timeline

  • 2026-05-17: advisory: GitHub Security Advisory published
  • 2026-05-20: patched: Fix committed to repository
  • 2026-07-20: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.