PT-2025-20926 · Flask+1 · Flask+1

Published 2025-05-13 · Updated 2025-05-26 · CVE-2025-47278

Positive Technologies (AI Summary)

CVSS v4.0

1.8

Low

Base vector

AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Flask versions 3.1.0

Description: The issue arises from the incorrect handling of fallback key configuration in Flask, where the last fallback key is used for signing instead of the current signing key. This is due to Flask constructing the list of keys in reverse, passing the signing key first. Sites using key rotation by setting SECRET KEY FALLBACKS may unexpectedly sign their sessions with stale keys, impeding their transition to fresher keys. However, sessions are still signed, preventing data integrity loss.

Recommendations: For Flask version 3.1.0, update to version 3.1.1 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-683

Related Identifiers

AZL-77828

AZL-77831

CVE-2025-47278

GHSA-4GRG-W6V8-C28G

OPENSUSE-SU-2025:15152-1

USN-7534-1

Affected Products

Flask

Ubuntu

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47278.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2025-47278 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-77831 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-47278 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7534-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-47278 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-47278 · Security Note
• https://osv.dev/vulnerability/GHSA-4grg-w6v8-c28g · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-47278 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47278 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15152-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7534-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-47278 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-77828 · Vendor Advisory
• https://github.com/pallets/flask/security/advisories/GHSA-4grg-w6v8-c28g · Note