{"action":"Upgrade flask-httpauth to 4.8.1 or later.","affected":[{"fixed":"4.8.1","introduced":"0"}],"component":"flask-httpauth","cve_ids":["CVE-2026-34531"],"ecosystem":"PyPI","epss":0.00479,"exploited":false,"fixed_versions":["4.8.1"],"ghsa_id":"GHSA-p44q-vqpr-4xmg","id":"tcs_01M5KFS8BZX0YKSQ0QACM2YWPR","modified_at":"2026-07-13T07:26:38.928844846Z","published_at":"2026-03-31T23:48:02Z","references":["https://osv.dev/vulnerability/GHSA-p44q-vqpr-4xmg","https://github.com/miguelgrinberg/Flask-HTTPAuth/security/advisories/GHSA-p44q-vqpr-4xmg","https://nvd.nist.gov/vuln/detail/CVE-2026-34531","https://github.com/miguelgrinberg/flask-httpauth/commit/b15ffe9e50e110d7174ccd944f642079e1dcf9ee","https://github.com/miguelgrinberg/Flask-HTTPAuth","https://github.com/miguelgrinberg/Flask-HTTPAuth/releases/tag/v4.8.1","https://lists.debian.org/debian-lts-announce/2026/05/msg00049.html"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-p44q-vqpr-4xmg","url":"https://osv.dev/vulnerability/GHSA-p44q-vqpr-4xmg"}],"summary":"Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client"}