CVE-2026-34531

medium

Published 2026-03-31 · Modified 2026-05-28

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

6.5

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

CVSS v4 NEW

—

not yet in upstream

VIR risk

6.5

Description

Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client

Predictions

Exploit likelihood

75%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2026-34531 NameCVE-2026-34531 DescriptionFlask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to…

CVE-2026-34531

Name	CVE-2026-34531
Description	Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any users in its database with an empty string set as their token, then it could potentially authenticate the client request against any of those users. This issue has been patched in version 4.8.1.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4605-1
Debian Bugs	1132581

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-flask-httpauth (PTS)	bullseye	3.2.4-3.1	vulnerable
	bullseye (security)	3.2.4-3.1+deb11u1	fixed
	bookworm	4.5.0-4	vulnerable
	trixie	4.8.0-1	vulnerable
	forky, sid	4.8.1-1.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
python-flask-httpauth	source	bullseye	3.2.4-3.1+deb11u1		DLA-4605-1
python-flask-httpauth	source	(unstable)	4.8.1-1.1			1132581

Notes

[trixie] - python-flask-httpauth <no-dsa> (Minor issue)
[bookworm] - python-flask-httpauth <no-dsa> (Minor issue)
https://github.com/miguelgrinberg/Flask-HTTPAuth/security/advisories/GHSA-p44q-vqpr-4xmg
Fixed by: https://github.com/miguelgrinberg/flask-httpauth/commit/b15ffe9e50e110d7174ccd944f642079e1dcf9ee (v4.8.1)

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

[trixie] - python-flask-httpauth <no-dsa> (Minor issue)[bookworm] - python-flask-httpauth <no-dsa> (Minor issue)https://github.com/miguelgrinberg/Flask-HTTPAuth/security/advisories/GHSA-p44q-vqpr-4xmgFixed by: https://github.com/miguelgrinberg/flask-httpauth/commit/b15ffe9e50e110d7174ccd944f642079e1dcf9ee (v4.8.1)

OS impact

Debian Mixed 5 releases

Version	Status	Fixed in
trixie	Affected	—
sid	Fixed	`4.8.1-1.1`
forky	Fixed	`4.8.1-1.1`
bullseye	Fixed	`3.2.4-3.1+deb11u1`
bookworm	Affected	—

Package impact

Ecosystem	Package	Vulnerable	Fixed
PyPI	flask-httpauth	`<4.8.1`	`4.8.1`

Application impact

Vendor	Product	Versions	Fixed
miguelgrinberg	flask-httpauth	`{"endExcluding":"4.8.1"}`	`4.8.1`

References

CWEs

CWE-287

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.