{"action":"Upgrade flask-httpauth to 4.8.1 or later.","affected":[{"fixed":"4.8.1","introduced":"0"}],"component":"flask-httpauth","cve_ids":["CVE-2026-34531"],"ecosystem":"PyPI","epss":0.00337,"exploited":false,"fixed_versions":["4.8.1"],"ghsa_id":"GHSA-p44q-vqpr-4xmg","id":"tcs_01M5KGXRWZEN029W5PZPDNXQV4","modified_at":"2026-07-13T07:15:25.077686192Z","published_at":"2026-04-01T21:17:01.147Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2152","https://lists.debian.org/debian-lts-announce/2026/05/msg00049.html","https://github.com/miguelgrinberg/Flask-HTTPAuth/releases/tag/v4.8.1","https://github.com/miguelgrinberg/Flask-HTTPAuth/security/advisories/GHSA-p44q-vqpr-4xmg","https://github.com/miguelgrinberg/flask-httpauth/commit/b15ffe9e50e110d7174ccd944f642079e1dcf9ee"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"PYSEC-2026-2152","url":"https://osv.dev/vulnerability/PYSEC-2026-2152"}],"summary":"Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without pass"}