CVE-2025-47278

Flask is a web server gateway interface (WSGI) web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the `itsdangerous` library. A list of keys can be passed, and it expects the last (top) key in the list to be the most recent key, and uses that for signing. Flask was incorrectly constructing that list in reverse, passing the signing key first. Sites that have opted-in to use key rotation by setting `SECRET_KEY_FALLBACKS` care likely to unexpectedly be signing their sessions with stale keys, and their transition to fresher keys will be impeded. Sessions are still signed, so this would not cause any sort of data integrity loss. Version 3.1.1 contains a patch for the issue.

• CWE-683

• https://github.com/pallets/flask/commit/73d6504063bfa00666a92b07a28aaf906c532f09
• https://github.com/pallets/flask/releases/tag/3.1.1
• https://github.com/pallets/flask/security/advisories/GHSA-4grg-w6v8-c28g

Published

May 13, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-47272The CE Phoenix eCommerce platform, starting in version 1.0.9…5.5
• CVE-2025-47273setuptools is a package that allows users to download, build…8.8
• CVE-2025-47274ToolHive is a utility designed to simplify the deployment an…2.4
• CVE-2025-47275Auth0-PHP provides the PHP SDK for Auth0 Authentication and …9.1
• CVE-2025-47276Actualizer is a single shell script solution to allow develo…7.5
• CVE-2025-47277vLLM, an inference and serving engine for large language mod…9.8
• CVE-2025-47279Undici is an HTTP/1.1 client for Node.js. Prior to versions …3.1
• CVE-2025-4728A vulnerability was found in SourceCodester Best Online News…9.8
• CVE-2025-47280Umbraco Forms is a form builder that integrates with the Umb…6.1
• CVE-2025-47281Kyverno is a policy engine designed for cloud native platfor…7.7
• CVE-2025-47282Gardener External DNS Management is an environment to manage…9.9
• CVE-2025-47283Gardener implements the automated management and operation o…9.9