PT-2026-29428 · Unknown · Flask-Httpauth

Npbhatter17 · Published 2026-03-31 · Updated 2026-04-13 · CVE-2026-34531

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Flask-HTTPAuth versions prior to 4.8.1

Description Flask-HTTPAuth, when used with token authentication, could potentially authenticate client requests against any user in the database with an empty string set as their token if the client request does not include a token or includes an empty token. This occurs because the application's token verification callback function is invoked with an empty string as the token argument. This issue only applies to token authentication and applications that verify tokens by searching for them in a user database. It does not affect Basic or Digest authentication, or tokens verified through cryptographic means.

Recommendations Ensure no user in the user database has their token set to an empty string. Change the value of those tokens to NULL instead. Alternatively, upgrade to Flask-HTTPAuth version 4.8.1 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-34531

GHSA-P44Q-VQPR-4XMG

OPENSUSE-SU-2026:10518-1

OPENSUSE-SU-2026:20576-1

Affected Products

Flask-Httpauth

References · 16

• https://github.com/miguelgrinberg/Flask-HTTPAuth/security/advisories/GHSA-p44q-vqpr-4xmg · Vendor Advisory
• https://github.com/miguelgrinberg/flask-httpauth/commit/b15ffe9e50e110d7174ccd944f642079e1dcf9ee · Patch
• https://ubuntu.com/security/CVE-2026-34531 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34531 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34531 · Security Note
• https://osv.dev/vulnerability/GHSA-p44q-vqpr-4xmg · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10518-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34531 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-34531 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-34531 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20576-1 · Vendor Advisory
• https://github.com/miguelgrinberg/Flask-HTTPAuth/releases/tag/v4.8.1 · Note
• https://github.com/miguelgrinberg/Flask-HTTPAuth · Note
• https://suse.com/security/cve/CVE-2026-34531 · Note
• https://bugzilla.suse.com/1261355 · Note