CVE-2026-34531: Flask-HTTPAuth Auth Bypass Vulnerability

CVE-2026-34531 Overview

Flask-HTTPAuth is a popular Python extension that provides Basic, Digest, and Token HTTP authentication for Flask routes. A vulnerability exists in versions prior to 4.8.1 that allows authentication bypass when handling requests with empty or missing authentication tokens. When a client makes a request to a token-protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any users in its database with an empty string set as their token, the client request could potentially be authenticated against any of those users.

Critical Impact

Authentication bypass allowing unauthorized access to protected resources when users have empty tokens stored in the database.

Affected Products

• Flask-HTTPAuth versions prior to 4.8.1
• Flask applications using token-based authentication with Flask-HTTPAuth
• Applications with users that have empty string tokens in their database

Discovery Timeline

• 2026-04-01 - CVE CVE-2026-34531 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-34531

Vulnerability Analysis

This vulnerability is classified under CWE-287 (Improper Authentication). The flaw occurs in the token authentication flow where Flask-HTTPAuth fails to properly validate the presence and validity of authentication tokens before invoking the verification callback. When a request arrives without a token or with an empty token value, the library passes an empty string to the application's verification function rather than rejecting the request outright. This creates a dangerous scenario where applications that inadvertently have users with empty token values in their database could match against these empty-token requests.

The attack is network-accessible and requires no authentication, though exploitation complexity is considered high because it depends on a specific condition: the existence of users with empty tokens in the target application's database. A successful exploit could result in unauthorized access with the privileges of the matched user account, potentially leading to significant integrity impact through unauthorized actions.

Root Cause

The root cause lies in insufficient input validation within the token authentication handler. Instead of treating a missing or empty token as an immediate authentication failure, the library passes the empty string to the application's verification callback. This shifts the burden of empty-token validation entirely to the application developer, creating a security gap when developers don't explicitly handle this edge case in their verification logic.

Attack Vector

The attack vector is network-based, requiring only that an attacker can make HTTP requests to a token-protected endpoint. The attacker simply needs to send a request without an Authorization header, or with an empty token value. If the target application has any users with an empty string token stored in its database, the authentication mechanism may incorrectly validate the request as authenticated under one of those user accounts.

An attacker could exploit this by sending requests to token-protected endpoints without providing authentication credentials. The attack does not require any prior authentication or user interaction. If the target application's database contains users with empty tokens (which may occur due to data migration issues, application bugs, or improper user provisioning), the attacker could gain access to those accounts.

Detection Methods for CVE-2026-34531

Indicators of Compromise

• HTTP requests to protected endpoints without Authorization headers that result in successful responses (HTTP 200)
• Authentication logs showing successful logins associated with users that should not have valid tokens
• Unusual access patterns to sensitive endpoints from unexpected sources without proper credential presentation

Detection Strategies

• Monitor web application logs for requests to token-protected routes that lack authentication headers but return success responses
• Implement database auditing to detect users with empty or null token values
• Deploy web application firewall rules to flag requests missing required authentication headers on protected endpoints
• Review application access logs for anomalous authentication patterns indicating unauthorized access

Monitoring Recommendations

• Enable detailed authentication logging in Flask applications to capture all token verification attempts
• Set up alerts for successful authentications where the presented token is empty or missing
• Periodically audit user databases for accounts with empty or invalid token values
• Monitor for unusual API access patterns that could indicate exploitation of authentication bypass vulnerabilities

How to Mitigate CVE-2026-34531

Immediate Actions Required

• Upgrade Flask-HTTPAuth to version 4.8.1 or later immediately
• Audit your user database for any accounts with empty string tokens and remediate them
• Review authentication logs for evidence of exploitation attempts
• Implement additional validation in token verification callbacks to reject empty tokens

Patch Information

The vulnerability has been addressed in Flask-HTTPAuth version 4.8.1. The fix ensures that empty or missing tokens are properly handled and rejected before the verification callback is invoked. The patch is available through the standard Python package manager.

For more information, refer to the GitHub Security Advisory GHSA-p44q-vqpr-4xmg and the release notes for version 4.8.1. The specific fix can be reviewed in commit b15ffe9e.

Workarounds

• Add explicit empty token checks in your token verification callback before performing database lookups
• Implement a database constraint or application-level validation to prevent storing empty tokens for users
• Use web application firewall rules to reject requests to protected endpoints that lack authentication headers
• Consider implementing rate limiting on authentication endpoints to slow down potential exploitation attempts

# Upgrade Flask-HTTPAuth to patched version
pip install --upgrade Flask-HTTPAuth>=4.8.1

# Verify installed version
pip show Flask-HTTPAuth | grep Version