CVE-2026-46715 pallets-eco CVE debrief

Who should care

Defenders responsible for systems using Flask-Security-Too version 5.8.0 should assess their exposure and take action to mitigate the risk of session hijacking. This includes verifying their inventory of affected systems, assessing potential session impact, and upgrading to version 5.8.1 or applying compensating controls.

Why it matters

CVE-2026-46715 is a vulnerability in Flask-Security-Too's OAuth reauthentication flow that allows session hijacking. Defenders should prioritize verifying their inventory of affected systems, assessing potential session impact, and upgrading to version 5.8.1 or applying compensating controls. Evidence is limited, and further verification is required to determine the full scope of affected systems and potential exploitation.

• Session hijacking is possible for attackers who can operate an already-authenticated but stale victim session.
• Victim sessions can be treated as recently reauthenticated, enabling freshness-protected account actions to proceed.
• Defenders need to verify their inventory of systems using Flask-Security-Too version 5.8.0 and assess potential session impact.
• Remediation priority is high for systems using Flask-Security-Too version 5.8.0.

Technical summary

The vulnerability in Flask-Security-Too's OAuth reauthentication flow allows an attacker to hijack a victim's session by completing OAuth verification using their own OAuth identity. This occurs because the library incorrectly marks a session as fresh after verifying an OAuth account that belongs to a different user. Defenders should prioritize verifying their inventory of systems using Flask-Security-Too version 5.8.0 and assessing whether any sessions may have been affected. Evidence is limited, and further verification is required to determine the full scope of affected systems and potential exploitation.

Defensive priority

Defenders should prioritize verifying their inventory of systems using Flask-Security-Too version 5.8.0 and assessing whether any sessions may have been affected. They should also upgrade to version 5.8.1 or apply compensating controls to mitigate the risk of session hijacking.

Recommended defensive actions

• Verify inventory of systems using Flask-Security-Too version 5.8.0
• Assess whether any sessions may have been affected
• Upgrade to version 5.8.1 or apply compensating controls
• Monitor for suspicious session activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and affected version. However, there is limited information about potential exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.