https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 23:10:24 +0000 https://cve.radiocsirt.org/vuln/cve-2021-21241 <p><strong>Affected:</strong> Flask-Middleware flask-security-too</p> <p>The Python &#34;Flask-Security-Too&#34; package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user&#39;s authentication token in response to a GET request. Since GET requests aren&#39;t protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren&#39;t using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to &#34;0&#34; (seconds) which should make the token unusable.</p> <p><strong>Affected:</strong> Flask-Middleware flask-security-too</p> <p>The Python &#34;Flask-Security-Too&#34; package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user&#39;s authentication token in response to a GET request. Since GET requests aren&#39;t protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren&#39;t using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to &#34;0&#34; (seconds) which should make the token unusable.</p> https://cve.radiocsirt.org/vuln/cve-2021-21241