https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 08:36:00 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-234194 EUVD-2026-234194 https://cve.radiocsirt.org/vuln/euvd-2026-234194 https://cve.radiocsirt.org/vuln/fkie_cve-2022-24880 <p>flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work.</p> <p>flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-24880 https://cve.radiocsirt.org/vuln/ghsa-7r87-cj48-wj45 <p><strong>Affected:</strong> PyPI: flask-session-captcha</p> <p>### Impact flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session.</p> <p>The `captcha.validate()` function would return `None` if passed no value (e.g. by submitting a request with an empty form).</p> <p>If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed.</p> <p>Sample vulnerable code: ```python if captcha.validate() == False: ... # abort else: ... # do stuff ```</p> <p>### Patches A new version (1.2.1) is available that fixes the issue.</p> <p>### Workarounds Users can workaround the issue by not explicitly checking that the value is False.</p> <p>Checking the return value less explicitly should still work.</p> <p>```python if not captcha.validate(): ... # abort else: ... # do stuff ```</p> <p>```python if captcha.validate(): ... # do stuff else: ... # abort ```</p> <p>### References https://github.com/Tethik/flask-session-captcha/pull/27</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue in [the github repo](https://github.com/Tethik/flask-session-captcha)</p> <p><strong>Affected:</strong> PyPI: flask-session-captcha</p> <p>### Impact flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session.</p> <p>The `captcha.validate()` function would return `None` if passed no value (e.g. by submitting a request with an empty form).</p> <p>If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed.</p> <p>Sample vulnerable code: ```python if captcha.validate() == False: ... # abort else: ... # do stuff ```</p> <p>### Patches A new version (1.2.1) is available that fixes the issue.</p> <p>### Workarounds Users can workaround the issue by not explicitly checking that the value is False.</p> <p>Checking the return value less explicitly should still work.</p> <p>```python if not captcha.validate(): ... # abort else: ... # do stuff ```</p> <p>```python if captcha.validate(): ... # do stuff else: ... # abort ```</p> <p>### References https://github.com/Tethik/flask-session-captcha/pull/27</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue in [the github repo](https://github.com/Tethik/flask-session-captcha)</p> https://cve.radiocsirt.org/vuln/ghsa-7r87-cj48-wj45 https://cve.radiocsirt.org/vuln/gsd-2022-24880 gsd-2022-24880 https://cve.radiocsirt.org/vuln/gsd-2022-24880 https://cve.radiocsirt.org/vuln/pysec-2022-193 <p><strong>Affected:</strong> PyPI: flask-session-captcha</p> <p>flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work.</p> <p><strong>Affected:</strong> PyPI: flask-session-captcha</p> <p>flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work.</p> https://cve.radiocsirt.org/vuln/pysec-2022-193