CVE-2026-34531

{
  "id": "CVE-2026-34531",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-01T21:17:01.147",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any users in its database with an empty string set as their token, then it could potentially authenticate the client request against any of those users. This issue has been patched in version 4.8.1."
    },
    {
      "lang": "es",
      "value": "Flask-HTTPAuth proporciona autenticación HTTP Basic, Digest y por Token para rutas de Flask. Antes de la versión 4.8.1, en una situación donde el cliente realiza una solicitud a un recurso protegido por token sin pasar un token, o pasando un token vacío, Flask-HTTPAuth invocaría la función de callback de verificación de token de la aplicación con el argumento del token establecido como una cadena vacía. Si la aplicación tenía usuarios en su base de datos con una cadena vacía establecida como su token, entonces podría potencialmente autenticar la solicitud del cliente contra cualquiera de esos usuarios. Este problema ha sido parcheado en la versión 4.8.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "miguelgrinberg",
          "product": "Flask-HTTPAuth",
          "versions": [
            {
              "version": "< 4.8.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 4.2
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-02T15:13:05.354180Z",
          "id": "CVE-2026-34531",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    },
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:miguelgrinberg:flask-httpauth:*:*:*:*:*:python:*:*",
              "versionEndExcluding": "4.8.1",
              "matchCriteriaId": "27C90FDD-EF05-4AF2-BDE6-4E47481562E2"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/miguelgrinberg/Flask-HTTPAuth/releases/tag/v4.8.1",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/miguelgrinberg/Flask-HTTPAuth/security/advisories/GHSA-p44q-vqpr-4xmg",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/miguelgrinberg/flask-httpauth/commit/b15ffe9e50e110d7174ccd944f642079e1dcf9ee",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00049.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}