CVE-2025-47278 is a low-severity vulnerability in Flask 3.1.0 affecting the icloudpd product versions >=1.25.1 and <1.28.1_1. The issue arises from incorrect handling of fallback key configuration for session signing, causing the last fallback key to be used instead of the current signing key. This impacts sites using key rotation via SECRET_KEY_FALLBACKS, leading to sessions being signed with stale keys, which may impede key transitions but does not compromise data integrity.