Executive brief
Flask-Security, a library used to handle user authentication and authorization in Flask web applications, contains a flaw in how it validates web addresses during redirects. An attacker can trick the system into sending users to a malicious website by using specially formatted links that appear to be part of the trusted domain. This can be used in phishing campaigns to steal user credentials or distribute malware by leveraging the reputation of the trusted site.
Technical details
An open redirect vulnerability exists in `flask_security.utils.validate_redirect_url()` when `SECURITY_REDIRECT_ALLOW_SUBDOMAINS` is enabled. The root cause is a discrepancy between how Python's `urlsplit()` parses the authority component and how the validation logic checks for allowed subdomains. By using a backslash (e.g., `http://evil.com\.whitelist.com`), an attacker can satisfy the suffix check while the browser treats the portion before the backslash as the actual destination. This allows for unauthenticated, remote attackers to perform phishing attacks via a 302 redirect. The issue is addressed in version 5.8.1.
Affected products
- pallets-eco Flask-Security <= 5.8.0
Timeline
- 2026-05-21: disclosed
- 2026-06-23: advisory: GitHub Advisory published
- 2026-06-23: patched: Version 5.8.1 released
References
- https://api.github.com/users/RacerZ-fighting
- https://github.com/RacerZ-fighting
- https://api.github.com/users/RacerZ-fighting/gists%7B/gist_id%7D
- https://api.github.com/users/RacerZ-fighting/repos
- https://avatars.githubusercontent.com/u/78632303?v=4
- https://api.github.com/users/RacerZ-fighting/events%7B/privacy%7D