Update dependency Flask-HTTPAuth to v4.8.1 [SECURITY] (master)

[renovatebot-confluentinc]

For any questions/concerns about this PR, please review the Renovate Bot wiki/FAQs, or the #renovatebot Slack channel.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
Flask-HTTPAuth	==4.4.0 → ==4.8.1

GitHub Vulnerability Alerts

CVE-2026-34531

Summary

In a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any users in its database with an empty string set as their token, then it could potentially authenticate the client request against any of those users.

Notes

• This issue applies only to token authentication
• This issue applies only when the application verifies tokens by searching for them in a user database.
• This issue applies only if the application stores empty strings as user tokens when the user does not have an assigned token. It does not apply if the application sets those tokens to NULL instead.
• Tokens that are verified through cryptographic means (such as JWTs) are not affected by this issue.
• Basic and Digest authentication are not affected by this issue.

Remediation

To protect against this issue, developers should make sure that no user in the user database has their token set to an empty string. If there are such users, change the value of those tokens to NULL instead.

Alternatively, developers can upgrade their projects to Flask-HTTPAuth>=4.8.1, which fixes this issue.

---

Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client

CVE-2026-34531 / GHSA-p44q-vqpr-4xmg

More information

Details

Summary

In a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any users in its database with an empty string set as their token, then it could potentially authenticate the client request against any of those users.

Notes

• This issue applies only to token authentication
• This issue applies only when the application verifies tokens by searching for them in a user database.
• This issue applies only if the application stores empty strings as user tokens when the user does not have an assigned token. It does not apply if the application sets those tokens to NULL instead.
• Tokens that are verified through cryptographic means (such as JWTs) are not affected by this issue.
• Basic and Digest authentication are not affected by this issue.

Remediation

To protect against this issue, developers should make sure that no user in the user database has their token set to an empty string. If there are such users, change the value of those tokens to NULL instead.

Alternatively, developers can upgrade their projects to Flask-HTTPAuth>=4.8.1, which fixes this issue.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

References

• https://github.com/miguelgrinberg/Flask-HTTPAuth/security/advisories/GHSA-p44q-vqpr-4xmg
• https://nvd.nist.gov/vuln/detail/CVE-2026-34531
• https://github.com/miguelgrinberg/flask-httpauth/commit/b15ffe9e50e110d7174ccd944f642079e1dcf9ee
• https://github.com/miguelgrinberg/Flask-HTTPAuth
• https://github.com/miguelgrinberg/Flask-HTTPAuth/releases/tag/v4.8.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[service-bot-app]

Could not automerge PR: CI checks have not passed