In Flask-Security-Too versions 5.8.0 and 5.8.1, the WebAuthn reauthentication path lacks a critical check to ensure that the WebAuthn credential used for reauthentication belongs to the currently authenticated user. Unlike the OAuth reauthentication path, which verifies that the user email matches the current session user, the WebAuthn path does not compare the credential's associated user to the session user. The state token used in WebAuthn reauthentication does not bind to any user, allowing replay across sessions. Consequently, an attacker with any WebAuthn credential registered on the system can submit their own WebAuthn proof within a victim's session to bypass the freshness requirement. This vulnerability requires the attacker to be authenticated on the same Flask-Security deployment and able to send requests within the victim's session context (e.g., via CSRF, XSS, or session fixation).

An authenticated attacker who possesses any WebAuthn credential registered on the target deployment can bypass the session freshness check in another user's session. This bypass undermines the protection intended to require recent reauthentication for sensitive operations, potentially allowing the attacker to perform actions that should be restricted to freshly authenticated sessions. The vulnerability does not grant initial access but escalates the attacker's ability within an existing session context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. As of the information provided, no official fix has been released for the WebAuthn reauthentication path in versions 5.8.0 and 5.8.1. Users should monitor the Flask-Security-Too project for updates addressing this issue. In the meantime, restrict the ability of attackers to send requests within victim sessions by mitigating CSRF, XSS, and session fixation vulnerabilities in the application environment.