CVE-2021-21241
CSRF can expose users authentication token in Flask-Security-Too
The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
CSRF can expose users authentication token in Flask-Security-Too
The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.
- Record
CVE-2021-21241- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
EUVDEUVD-2021-0087
The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.
- Record
EUVD-2021-0087- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hh7m-rx4f-4vpv
CSRF can expose users authentication token
Issue
The /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token.
Patches
Version 3.4.5 and soon to be released 4.0.0 are patched.
Workarounds
If you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.
References
None
- Record
GHSA-hh7m-rx4f-4vpv- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N - CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
NVD
The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.
- Record
CVE-2021-21241- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.
- Record
CVE-2021-21241- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-21241
The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.
- Record
DEBIAN-CVE-2021-21241- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-hh7m-rx4f-4vpv
CSRF can expose users authentication token
Issue
The /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token.
Patches
Version 3.4.5 and soon to be released 4.0.0 are patched.
Workarounds
If you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.
References
None
- Record
GHSA-hh7m-rx4f-4vpv- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N - CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13561-1 No score
python310-Flask-Security-Too-5.3.2-3.1 on GA media
These are all security issues fixed in the python310-Flask-Security-Too-5.3.2-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13561-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14555-1 No score
python310-Flask-Security-5.5.2-1.1 on GA media
These are all security issues fixed in the python310-Flask-Security-5.5.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14555-1- Updated
- 2026-11-02
OSVPYSEC-2021-91 No score
The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.
- Record
PYSEC-2021-91- Updated
- 2026-11-02
OSVSUSE-SU-2022:3093-1 No score
Security update for python-Flask-Security-Too
This update for python-Flask-Security-Too fixes the following issues:
- CVE-2021-21241: Fixed an issue where GET requests lacking CSRF protection to certain endpoints could return the user's authentication token (bsc#1181058).
- Record
SUSE-SU-2022:3093-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flask-security-tooPyPI |
3.3.0 up to 3.4.5 | 3.4.5 |
flask-securityDebian:12 |
before 4.0.0-1 | 4.0.0-1 |
flask-securityDebian:13 |
before 4.0.0-1 | 4.0.0-1 |
flask-securityDebian:14 |
before 4.0.0-1 | 4.0.0-1 |
flask-security-tooPyPI |
3.3.0 up to 3.4.5, plus listed versions 3.3.13.3.23.3.33.4.03.4.13.4.23.4.33.4.4 |
3.4.5 |
python-Flask-Security-TooSUSE:Linux Enterprise Module for Basesystem 15 SP3 |
before 3.4.2-150200.3.3.1 | 3.4.2-150200.3.3.1 |
python-Flask-Security-TooSUSE:Linux Enterprise Module for Basesystem 15 SP4 |
before 3.4.2-150200.3.3.1 | 3.4.2-150200.3.3.1 |
python-Flask-Security-TooSUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS |
before 3.4.2-150200.3.3.1 | 3.4.2-150200.3.3.1 |
python-Flask-Security-TooSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS |
before 3.4.2-150200.3.3.1 | 3.4.2-150200.3.3.1 |
python-Flask-Security-TooSUSE:Linux Enterprise Server 15 SP2-BCL |
before 3.4.2-150200.3.3.1 | 3.4.2-150200.3.3.1 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-Flask-Security-TooSUSE:Linux Enterprise Server 15 SP2-LTSS |
before 3.4.2-150200.3.3.1 | 3.4.2-150200.3.3.1 |
python-Flask-Security-TooSUSE:Linux Enterprise Server for SAP Applications 15 SP2 |
before 3.4.2-150200.3.3.1 | 3.4.2-150200.3.3.1 |
python-Flask-Security-TooSUSE:Manager Proxy 4.1 |
before 3.4.2-150200.3.3.1 | 3.4.2-150200.3.3.1 |
python-Flask-Security-TooSUSE:Manager Retail Branch Server 4.1 |
before 3.4.2-150200.3.3.1 | 3.4.2-150200.3.3.1 |
python-Flask-Security-TooSUSE:Manager Server 4.1 |
before 3.4.2-150200.3.3.1 | 3.4.2-150200.3.3.1 |
python-Flask-Security-TooSUSE:Enterprise Storage 7 |
before 3.4.2-150200.3.3.1 | 3.4.2-150200.3.3.1 |
python-Flask-Security-TooopenSUSE:Leap 15.3 |
before 3.4.2-150200.3.3.1 | 3.4.2-150200.3.3.1 |
python-Flask-Security-TooopenSUSE:Leap 15.4 |
before 3.4.2-150200.3.3.1 | 3.4.2-150200.3.3.1 |
python-Flask-SecurityopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 5.5.2-1.1 | 5.5.2-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-21241 is a high vulnerability (CVSS 7.4) in Flask-middleware Flask-security-too, published January 11, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.93%, the 60th percentile. Fixed in flask-security-too 3.4.5.
References
github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv
pypi.org/project/Flask-Security-Too
Show 14 moreShow less
nvd.nist.gov/vuln/detail/CVE-2021-21241
web.archive.org/web/20210118165844/https://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5
security-tracker.debian.org/tracker/CVE-2021-21241
suse.com/support/update/announcement/2022/suse-su-20223093-1
bugzilla.suse.com/1181058