Authentication Bypass Vulnerability in Flask-HTTPAuth by Miguel Grinberg

CVE-2026-34531

What is CVE-2026-34531?

A vulnerability exists in Flask-HTTPAuth that allows an attacker to bypass token authentication under specific conditions. If a client requests access to a resource protected by token authentication without providing a valid token, the framework may erroneously pass an empty string to the application's token verification function. This flaw could lead to unintended access if any user in the database is associated with an empty token. This issue has been resolved in version 4.8.1, enhancing the overall security of the framework.

References