Executive brief
Flask-Security-Too is a library used to handle user authentication and security in Python web applications. A flaw in its WebAuthn implementation allows an attacker who is already logged into their own account to bypass 'freshness' checks on a victim's session. This means if an attacker gains temporary access to a victim's active session, they can perform sensitive actions like changing passwords or emails by using their own security key instead of the victim's.
Technical details
A vulnerability in `flask_security/webauthn.py` allows a reauthentication freshness bypass. The `webauthn_verify_response` function updates the session's freshness timestamp (`fs_paa`) upon receiving a valid WebAuthn assertion, but it fails to verify that the user associated with the provided credential matches the `current_user` of the session. An authenticated attacker can obtain a `wan_state` token from a victim's session and submit their own WebAuthn assertion to satisfy the freshness requirement. This allows the attacker to access endpoints protected by `@auth_required(within=...)`, such as password changes or MFA configuration, within the victim's session context. This issue persists in version 5.8.1 despite a similar fix being applied to the OAuth path.
Affected products
- pallets-eco Flask-Security-Too >= 5.8.0, <= 5.8.1
Timeline
- 2026-05-22: other: Related OAuth freshness bypass (GHSA-97r5-pg8x-p63p) published
- 2026-07-07: disclosed: Advisory published by GitHub