{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"5.8.0","last_affected":"5.8.1"}],"component":"flask-security-too","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-f66q-9rf6-8795","id":"tcs_01M5KFEKESHRQMQMDKF7NFDJPQ","modified_at":"2026-09-10T03:50:51.960981732Z","published_at":"2026-07-07T23:43:12Z","references":["https://osv.dev/vulnerability/GHSA-f66q-9rf6-8795","https://github.com/pallets-eco/flask-security/security/advisories/GHSA-f66q-9rf6-8795","https://github.com/pallets-eco/flask-security"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-f66q-9rf6-8795","url":"https://osv.dev/vulnerability/GHSA-f66q-9rf6-8795"}],"summary":"Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion"}