Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any users in its database with an empty string set as their token, then it could potentially authenticate the client request against any of those users. This issue has been patched in version 4.8.1.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4605 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4605-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Emmanuel Arias     May 28, 2026                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-flask-httpauth     Version        : 3.2.4-3.1+deb11u1     CVE ID         : CVE-2026-34531     Debian Bug     : 1132581

    A vulnerability was found in python-flask-httpauth, a Flask extension that     simplifies the use of HTTP authentication with Flask routes, that in a situation     where the client makes a request to a token protected resource without passing a     token, or passing an empty token, python-flask-httpauth would invoke the     application's token verification callback function with the token argument set     to an empty string. If the application had any users in its database with an     empty string set as their token, then it could potentially authenticate the     client request against any of those users.

    For Debian 11 bullseye, this problem has been fixed in version     3.2.4-3.1+deb11u1.

    We recommend that you upgrade your python-flask-httpauth packages.

    For the detailed security status of python-flask-httpauth please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-flask-httpauth

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-fd53570465 advisory.

    Update to version 4.8.1 (#2454342)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-04d6f223e0 advisory.

    Update to version 4.8.1 (#2454342)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version     4.8.1, in a situation where the client makes a request to a token protected resource without passing a     token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification     callback function with the token argument set to an empty string. If the application had any users in its     database with an empty string set as their token, then it could potentially authenticate the client     request against any of those users. This issue has been patched in version 4.8.1. (CVE-2026-34531)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version
    4.8.1, in a situation where the client makes a request to a token protected resource without passing a
    token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification
    callback function with the token argument set to an empty string. If the application had any users in its
    database with an empty string set as their token, then it could potentially authenticate the client
    request against any of those users. This issue has been patched in version 4.8.1. (CVE-2026-34531)

ID	Name	Product	Family	Severity
317441	Debian dla-4605 : python-flask-httpauth-doc - security update	Nessus	Debian Local Security Checks	high
310536	Fedora 44 : python-flask-httpauth (2026-fd53570465)	Nessus	Fedora Local Security Checks	high
306618	Fedora 43 : python-flask-httpauth (2026-04d6f223e0)	Nessus	Fedora Local Security Checks	high
304754	Linux Distros Unpatched Vulnerability : CVE-2026-34531	Nessus	Misc.	high
439542	SCA: security update for Flask-HTTPAuth (GHSA-p44q-vqpr-4xmg)	Tenable Cloud Security	SCA Checks	high
439542	SCA: security update for Flask-HTTPAuth (GHSA-p44q-vqpr-4xmg)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-34531

high

Tenable Plugins

high

high

high

high

high

high