Threat Intelligence Database

Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim session, they can complete OAuth verification using their own OAuth identity. The victim session is then treated as recently reauthenticated, allowing freshness-protected account actions to proceed. Version 5.8.1 contains a fix for this issue.

Flask-Security-Too versions 5.8.0 and 5.8.1 contain a vulnerability in the WebAuthn reauthentication process that allows an authenticated attacker to bypass session freshness checks. The flaw occurs because the system marks a session as reauthentication-fresh after processing a WebAuthn assertion from any credential, without verifying that the credential belongs to the current session user. This enables an attacker who owns any WebAuthn credential registered on the deployment to satisfy the freshness gate of another user's session, potentially allowing sensitive actions that require recent reauthentication.