Flask-Security-Too WebAuthn reauthentication freshness bypass

Severity: medium · CVSS 6.3 · Published 2026-07-07

Flask-Security-Too is a library used to handle user authentication and security in Python web applications. A flaw in its WebAuthn implementation allows an attacker who is already logged into their own account to bypass 'freshness' checks on a victim's session. This means if an attacker gains temporary access to a victim's active session, they can perform sensitive actions like changing passwords or emails by using their own security key instead of the victim's.

Technologies: Flask-Security-Too (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 6.3, published 7 July 2026.
Which products and versions are affected?
Flask-Security-Too (PyPI) >= 5.8.0, <= 5.8.1.
Is there a fix for This vulnerability?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run Flask-Security-Too (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in `flask_security/webauthn.py` allows a reauthentication freshness bypass. The `webauthn_verify_response` function updates the session's freshness timestamp (`fs_paa`) upon receiving a valid WebAuthn assertion, but it fails to verify that the user associated with the provided credential matches the `current_user` of the session. An authenticated attacker can obtain a `wan_state` token from a victim's session and submit their own WebAuthn assertion to satisfy the freshness requirement. This allows the attacker to access endpoints protected by `@auth_required(within=...)`, such as password changes or MFA configuration, within the victim's session context. This issue persists in version 5.8.1 despite a similar fix being applied to the OAuth path.

Affected products

  • pallets-eco Flask-Security-Too >= 5.8.0, <= 5.8.1

Timeline

  • 2026-05-22: other: Related OAuth freshness bypass (GHSA-97r5-pg8x-p63p) published
  • 2026-07-07: disclosed: Advisory published by GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.