6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34531

CVE-2026-34531: Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client

Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any users in its database with an empty string set as their token, then it could potentially authenticate the client request against any of those users. This issue has been patched in version 4.8.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34531

CVE-2026-34531:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Flask-HTTPAuth	pip	<= 4.8.0	4.8.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described in GHSA-p44q-vqpr-4xmg lies in how Flask-HTTPAuth handles missing authentication tokens. The advisory states that when a client makes a request without a token or with an empty one, the application's token verification callback is invoked with an empty string. This could lead to an improper authentication vulnerability if any user in the database has an empty string as their token.

To pinpoint the vulnerable function, I analyzed the changes between the last vulnerable version (4.8.0) and the first patched version (4.8.1). The key change was found in commit b15ffe9e50e110d7174ccd944f642079e1dcf9ee, titled "Do not accept empty tokens".

This commit modifies the authenticate method within the HTTPTokenAuth class in src/flask_httpauth.py. The vulnerable code was:

token = getattr(auth, 'token', '')
if self.verify_token_callback:
    return self.ensure_sync(self.verify_token_callback)(token)

This code retrieves the token, defaults to an empty string ('') if it's not present, and then unconditionally calls the verification callback.

The patch changes this logic to:

token = getattr(auth, 'token', None)
if token and self.verify_token_callback:
    return self.ensure_sync(self.verify_token_callback)(token)

Now, if the token is missing, it defaults to None, and the if token and ... check prevents the verification callback from being executed. This directly remediates the described vulnerability. Therefore, the HTTPTokenAuth.authenticate function is the precise location of the vulnerability.

Vulnerable functions

HTTPTokenAuth.authenticate

src/flask_httpauth.py

The `authenticate` method in the `HTTPTokenAuth` class was vulnerable. It used `getattr(auth, 'token', '')` to retrieve the token, which defaulted to an empty string if the token was missing from the request. It then proceeded to call the user-defined `verify_token_callback` with this empty string. If an application had a user with an empty string as a valid token in its database, an attacker could gain access to that account by sending a request without any token.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.