CVE-2026-46715

Name of the Vulnerable Software and Affected Versions Flask-Security-Too version 5.8.0

Description An issue in the OAuth reauthentication flow allows a session to be marked as fresh after verifying an OAuth account that belongs to a different user. If an attacker controls an already-authenticated but stale session of a victim, they can complete OAuth verification using their own identity. This causes the victim's session to be treated as recently reauthenticated, bypassing freshness protections for sensitive account actions. This was demonstrated using the /change-username endpoint.

The flaw exists in the OAuth verification callback where the oauth response common() function resolves the OAuth provider identity to a user, and the oauth verify response() function updates the session freshness timestamp without verifying that the resolved OAuth user matches the current authenticated session user.

Recommendations For version 5.8.0, ensure that OAuth verification is rejected unless the resolved OAuth user matches the current user before updating the fs paa session variable.