flask-security-too@3.3.0 vulnerabilities

Affected versions of this package are vulnerable to Open Redirect via the the /login and /register routes, using the ?next parameter.

Note:

With Werkzeug >=2.1.0 the autocorrect_location_header configuration was changed to False - which means that location headers in redirects are relative by default. Thus, this issue may impact applications that were previously not impacted, if they are using Werkzeug >=2.1.0 as the WSGI layer.

Upgrade Flask-Security-Too to version 5.3.3 or higher.

Affected versions of this package are vulnerable to Authentication Bypass such that it is possible for a malicious 3rd party to access the QRcode and therefore gain access to two-factor authentication codes.

Note:

The /tf-qrcode endpoint is ONLY accessible while the user is initially setting up their device. Once setup is complete, there is no vulnerability.

Upgrade Flask-Security-Too to version 3.4.5 or higher.

Affected versions of this package are vulnerable to Open Redirect. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path.

This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False`.

Upgrade Flask-Security-Too to version 4.1.0 or higher.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). When a user is setting up two-factor authentication using an authenticator app, a QRcode is generated and made available via a GET request to /tf-qrcode. Since GETs do not have any CSRF protection, it is possible a malicious 3rd party could access the QRcode and therefore gain access to two-factor authentication codes. Note that the /tf-qrcode endpoint is ONLY accessible while the user is initially setting up their device. Once setup is complete, there is no vulnerability.

Upgrade Flask-Security-Too to version 3.4.5 or higher.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). The /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token.

Upgrade Flask-Security-Too to version 3.4.5 or higher.