Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client

An attacker can exploit this vulnerability by crafting requests to token-protected resources without providing a valid token or by providing an empty token. If the application’s database contains users with empty string tokens, the attacker can authenticate as any of those users. This could lead to unauthorized access to sensitive data, modification of application settings, or even complete control of the application, depending on the privileges associated with the authenticated user. The impact is particularly severe in applications where user tokens are used for authentication and authorization, as it effectively bypasses the intended security controls. This vulnerability highlights the importance of robust token validation and secure user credential management.

Applications built with Python and utilizing Flask-HTTPAuth for authentication are at risk. This includes web applications, APIs, and microservices that rely on Flask-HTTPAuth for token-based authentication. Specifically, applications with legacy user databases or those that allow users to set empty tokens are particularly vulnerable.

• python / server:

import os
import subprocess

def check_flask_httpauth_version():
    try:
        result = subprocess.check_output(['pip', 'show', 'Flask-HTTPAuth'], stderr=subprocess.STDOUT, text=True)
        for line in result.splitlines():
            if line.startswith('Version:'):
                version = line.split(':')[1].strip()
                if version <= '4.8.0':
                    print(f"Vulnerability detected: Flask-HTTPAuth version {version} is vulnerable.")
                else:
                    print("Flask-HTTPAuth is up to date.")
                return
    except FileNotFoundError:
        print("Flask-HTTPAuth is not installed.")

check_flask_httpauth_version()

1. 2026-03-31Disclosure

   disclosure

1. Réservé2026-03-30
2. Publiée2026-03-31
3. Modifiée2026-04-06
4. EPSS mis à jour2026-04-09

The primary mitigation for CVE-2026-34531 is to upgrade Flask-HTTPAuth to version 4.8.1 or later. If upgrading is not immediately feasible, consider implementing a workaround by ensuring that the token verification callback function explicitly rejects empty tokens. This can be achieved by adding a check at the beginning of the callback to return False if the token is an empty string. Additionally, review your application's user database to identify and correct any users with empty string tokens. After upgrading, confirm the fix by attempting to authenticate with an empty token and verifying that authentication fails.