CVE catalog
CVE-2021-21241
flask-security: CVE-2021-21241
- Severity
- High · CVSS 7.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.93% · Oct 25, 2026
The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | flask-security | sid | 5.9.1-1 | fixed |
| Debian | flask-security | forky | 5.9.1-1 | fixed |
| Debian | flask-security | trixie | 5.6.1-1 | fixed |
| Debian | flask-security | bookworm | 5.1.2-1 | fixed |
| Opensuse | python-Flask-Security | tumbleweed | 5.5.2-1.1 | fixed |
| Suse | python-Flask-Security-Too | linux enterprise module for basesystem 15 sp3 | 3.4.2-150200.3.3.1 | fixed |
| Suse | python-Flask-Security-Too | linux enterprise module for basesystem 15 sp4 | 3.4.2-150200.3.3.1 | fixed |
| Suse | python-Flask-Security-Too | linux enterprise high performance computing 15 sp2-espos | 3.4.2-150200.3.3.1 | fixed |
| Suse | python-Flask-Security-Too | linux enterprise high performance computing 15 sp2-ltss | 3.4.2-150200.3.3.1 | fixed |
| Suse | python-Flask-Security-Too | linux enterprise server 15 sp2-bcl | 3.4.2-150200.3.3.1 | fixed |
| Suse | python-Flask-Security-Too | linux enterprise server 15 sp2-ltss | 3.4.2-150200.3.3.1 | fixed |
| Suse | python-Flask-Security-Too | linux enterprise server for sap applications 15 sp2 | 3.4.2-150200.3.3.1 | fixed |
| Suse | python-Flask-Security-Too | manager proxy 4.1 | 3.4.2-150200.3.3.1 | fixed |
| Suse | python-Flask-Security-Too | manager retail branch server 4.1 | 3.4.2-150200.3.3.1 | fixed |
| Suse | python-Flask-Security-Too | manager server 4.1 | 3.4.2-150200.3.3.1 | fixed |
| Suse | python-Flask-Security-Too | enterprise storage 7 | 3.4.2-150200.3.3.1 | fixed |
| Opensuse | python-Flask-Security-Too | leap 15.3 | 3.4.2-150200.3.3.1 | fixed |
| Opensuse | python-Flask-Security-Too | leap 15.4 | 3.4.2-150200.3.3.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | flask-security | source | sid | 4.0.0-1 | not yet assigned | Not reported | [980189] |
| Debian | flask-security | source | forky | 4.0.0-1 | not yet assigned | Not reported | [980189] |
| Debian | flask-security | source | trixie | 4.0.0-1 | not yet assigned | Not reported | [980189] |
| Debian | flask-security | source | bookworm | 4.0.0-1 | not yet assigned | Not reported | [980189] |
| Opensuse | python-Flask-Security | rpm | tumbleweed | 5.5.2-1.1 | Not reported | OPENSUSE-SU-2024:14555-1 | Not reported |
| Suse | python-Flask-Security-Too | rpm | linux enterprise module for basesystem 15 sp3 | 3.4.2-150200.3.3.1 | Not reported | SUSE-SU-2022:3093-1 | Not reported |
| Suse | python-Flask-Security-Too | rpm | linux enterprise module for basesystem 15 sp4 | 3.4.2-150200.3.3.1 | Not reported | SUSE-SU-2022:3093-1 | Not reported |
| Suse | python-Flask-Security-Too | rpm | linux enterprise high performance computing 15 sp2-espos | 3.4.2-150200.3.3.1 | Not reported | SUSE-SU-2022:3093-1 | Not reported |
| Suse | python-Flask-Security-Too | rpm | linux enterprise high performance computing 15 sp2-ltss | 3.4.2-150200.3.3.1 | Not reported | SUSE-SU-2022:3093-1 | Not reported |
| Suse | python-Flask-Security-Too | rpm | linux enterprise server 15 sp2-bcl | 3.4.2-150200.3.3.1 | Not reported | SUSE-SU-2022:3093-1 | Not reported |
| Suse | python-Flask-Security-Too | rpm | linux enterprise server 15 sp2-ltss | 3.4.2-150200.3.3.1 | Not reported | SUSE-SU-2022:3093-1 | Not reported |
| Suse | python-Flask-Security-Too | rpm | linux enterprise server for sap applications 15 sp2 | 3.4.2-150200.3.3.1 | Not reported | SUSE-SU-2022:3093-1 | Not reported |
| Suse | python-Flask-Security-Too | rpm | manager proxy 4.1 | 3.4.2-150200.3.3.1 | Not reported | SUSE-SU-2022:3093-1 | Not reported |
| Suse | python-Flask-Security-Too | rpm | manager retail branch server 4.1 | 3.4.2-150200.3.3.1 | Not reported | SUSE-SU-2022:3093-1 | Not reported |
| Suse | python-Flask-Security-Too | rpm | manager server 4.1 | 3.4.2-150200.3.3.1 | Not reported | SUSE-SU-2022:3093-1 | Not reported |
| Suse | python-Flask-Security-Too | rpm | enterprise storage 7 | 3.4.2-150200.3.3.1 | Not reported | SUSE-SU-2022:3093-1 | Not reported |
| Opensuse | python-Flask-Security-Too | rpm | leap 15.3 | 3.4.2-150200.3.3.1 | Not reported | SUSE-SU-2022:3093-1 | Not reported |
| Opensuse | python-Flask-Security-Too | rpm | leap 15.4 | 3.4.2-150200.3.3.1 | Not reported | SUSE-SU-2022:3093-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [python313-Flask-Security]Unknown
Source package: [python-Flask-Security]
Details (1)
5.8.1-1.2· noarch · tumbleweedUnknown · Fixed:
5.5.2-1.1Version impact unknown
dsa · python-Flask-Security · opensuse · tumbleweed
- [python314-Flask-Security]Unknown
Source package: [python-Flask-Security]
Details (1)
5.8.1-1.2· noarch · tumbleweedUnknown · Fixed:
5.5.2-1.1Version impact unknown
dsa · python-Flask-Security · opensuse · tumbleweed
[Debian 12 (Bookworm)]
- [python3-flask-security]Fixed
Source package: [flask-security]
Details (2)
5.1.2-1· all · bookwormFixed · Fixed:
4.0.0-1dsa · flask-security · debian · bookworm; dsa · flask-security · debian · 12
5.1.2-1· all · bookwormFixed · Fixed:
4.0.0-1dsa · flask-security · debian · bookworm; dsa · flask-security · debian · 12
- [python-flask-security-doc]Fixed
Source package: [flask-security]
Details (2)
5.1.2-1· all · bookwormFixed · Fixed:
4.0.0-1dsa · flask-security · debian · bookworm; dsa · flask-security · debian · 12
5.1.2-1· all · bookwormFixed · Fixed:
4.0.0-1dsa · flask-security · debian · bookworm; dsa · flask-security · debian · 12
[Debian 13 (Trixie)]
- [python3-flask-security]Fixed
Source package: [flask-security]
Details (2)
5.6.1-1· all · trixieFixed · Fixed:
4.0.0-1dsa · flask-security · debian · 13
5.6.1-1· all · trixieFixed · Fixed:
4.0.0-1dsa · flask-security · debian · 13
- [python-flask-security-doc]Fixed
Source package: [flask-security]
Details (2)
5.6.1-1· all · trixieFixed · Fixed:
4.0.0-1dsa · flask-security · debian · 13
5.6.1-1· all · trixieFixed · Fixed:
4.0.0-1dsa · flask-security · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_3093-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2021-21241]
- [https://osv.dev/vulnerability/SUSE-SU-2022:3093-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:14555-1]
- [https://security-tracker.debian.org/tracker/CVE-2021-21241]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]