{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34531", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-30T16:03:31.048Z", "datePublished": "2026-04-01T20:44:10.740Z", "dateUpdated": "2026-04-02T16:24:04.160Z"}, "containers": {"cna": {"title": "Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/miguelgrinberg/Flask-HTTPAuth/security/advisories/GHSA-p44q-vqpr-4xmg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/miguelgrinberg/Flask-HTTPAuth/security/advisories/GHSA-p44q-vqpr-4xmg"}, {"name": "https://github.com/miguelgrinberg/flask-httpauth/commit/b15ffe9e50e110d7174ccd944f642079e1dcf9ee", "tags": ["x_refsource_MISC"], "url": "https://github.com/miguelgrinberg/flask-httpauth/commit/b15ffe9e50e110d7174ccd944f642079e1dcf9ee"}, {"name": "https://github.com/miguelgrinberg/Flask-HTTPAuth/releases/tag/v4.8.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/miguelgrinberg/Flask-HTTPAuth/releases/tag/v4.8.1"}], "affected": [{"vendor": "miguelgrinberg", "product": "Flask-HTTPAuth", "versions": [{"version": "< 4.8.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-01T20:44:10.740Z"}, "descriptions": [{"lang": "en", "value": "Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any users in its database with an empty string set as their token, then it could potentially authenticate the client request against any of those users. This issue has been patched in version 4.8.1."}], "source": {"advisory": "GHSA-p44q-vqpr-4xmg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-02T15:13:05.354180Z", "id": "CVE-2026-34531", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T16:24:04.160Z"}}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:miguelgrinberg:flask-httpauth:*:*:*:*:*:python:*:*", "matchCriteriaId": "27C90FDD-EF05-4AF2-BDE6-4E47481562E2", "versionEndExcluding": "4.8.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any users in its database with an empty string set as their token, then it could potentially authenticate the client request against any of those users. This issue has been patched in version 4.8.1."}], "id": "CVE-2026-34531", "lastModified": "2026-04-16T16:21:05.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-01T21:17:01.147", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/miguelgrinberg/Flask-HTTPAuth/releases/tag/v4.8.1"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/miguelgrinberg/Flask-HTTPAuth/security/advisories/GHSA-p44q-vqpr-4xmg"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/miguelgrinberg/flask-httpauth/commit/b15ffe9e50e110d7174ccd944f642079e1dcf9ee"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Primary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.8.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Flask-HTTPAuth", "source": "cna", "vendor": "miguelgrinberg"}, "product": "flask-httpauth", "vendor": "miguelgrinberg"}], "analysis": {"en": {"generated_at": "2026-04-17T09:54:00.350327+00:00", "value": {"mitigation_remediation": ["Update Flask-HTTPAuth to version 4.8.1 or later", "Verify that no user records contain an empty token in the database", "Review and test the token verification logic to ensure it rejects empty tokens and handles missing tokens safely"], "summary": {"action": "Patch Immediately", "impact": "Authentication bypass"}, "threat_synthesis": {"affected_systems": "All installations of the miguelgrinberg:Flask-HTTPAuth package prior to version 4.8.1 are affected. Applications that use this library for Basic, Digest, or Token HTTP authentication and deploy older releases are vulnerable.", "description_and_impact": "Flask-HTTPAuth incorrectly invokes the token verification callback when a request omits a token or supplies an empty string. The callback receives the empty token value, and if the application database contains a user whose token is an empty string, the attacker can be authenticated as that user. This flaw is an authentication failure (CWE\u2011287) that can allow unauthorized access to protected resources, compromising confidentiality and integrity of the application.", "risk_and_exploitability": "The CVSS score of 6.5 indicates medium severity. The EPSS score is less than 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending an unauthenticated HTTP request to a token\u2011protected endpoint. No privileged local access is required, but the ability to authenticate as any user with an empty token presents a significant risk."}}}}, "created": "2026-04-02T07:47:33.142604+00:00", "updated": "2026-04-17T10:00:03.571034+00:00", "vendors": ["miguelgrinberg", "miguelgrinberg$PRODUCT$flask-httpauth"]}