CVE-2026-46715 in Flask-Security-Too
Summary
by MITRE • 07/20/2026
Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim session, they can complete OAuth verification using their own OAuth identity. The victim session is then treated as recently reauthenticated, allowing freshness-protected account actions to proceed. Version 5.8.1 contains a fix for this issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability in Flask-Security-Too version 5.8.0 represents a critical session management flaw that undermines the security of authentication flows within Flask applications. This issue specifically affects the OAuth reauthentication mechanism where the system incorrectly validates user sessions based on OAuth account ownership rather than proper session binding. The flaw allows for a form of session hijacking or privilege escalation where an attacker can leverage a legitimate but inactive victim session to gain unauthorized access to protected account functionalities.
The technical implementation of this vulnerability stems from improper session validation logic during the OAuth reauthentication process. When a user completes OAuth verification, the system should validate that the session being reauthenticated belongs to the same user who initiated the OAuth flow. However, version 5.8.0 fails to maintain proper session binding between the original authenticated session and the OAuth account being verified. This creates a condition where an attacker with access to a victim's stale session can complete OAuth verification using their own credentials, effectively impersonating the victim within the application.
From an operational perspective, this vulnerability exposes applications to significant risk as it allows attackers to bypass freshness checks that are designed to protect sensitive account operations. The freshness protection mechanism in Flask-Security-Too is intended to ensure that users must reauthenticate for critical actions after a period of inactivity or when performing high-risk operations. When an attacker can manipulate a victim's session to appear freshly authenticated, they gain access to these protected functions without proper authorization, potentially enabling account takeovers, data manipulation, or unauthorized transactions.
The vulnerability aligns with CWE-384, which addresses session fixation and improper session management, and relates to ATT&CK technique T1566 for credential access through social engineering or session manipulation. The attack vector specifically targets the authentication flow by exploiting the gap between session state management and OAuth verification logic. This allows attackers to maintain persistent access to victim accounts even after legitimate authentication has expired, effectively undermining the security controls that protect against unauthorized access.
Security mitigations for this vulnerability require immediate upgrade to version 5.8.1 or later where the fix properly validates session binding during OAuth reauthentication. Organizations should also implement additional monitoring for unusual OAuth verification patterns and ensure proper session invalidation policies are in place. The fix likely involves strengthening session validation checks to ensure that OAuth account verification cannot alter the state of sessions belonging to different users, thereby maintaining proper authentication boundaries and preventing cross-user session manipulation attacks.