Flask-HTTPAuth incorrectly invokes the token verification callback when a request omits a token or supplies an empty string. The callback receives the empty token value, and if the application database contains a user whose token is an empty string, the attacker can be authenticated as that user. This flaw is an authentication failure (CWE‑287) that can allow unauthorized access to protected resources, compromising confidentiality and integrity of the application.

All installations of the miguelgrinberg:Flask-HTTPAuth package prior to version 4.8.1 are affected. Applications that use this library for Basic, Digest, or Token HTTP authentication and deploy older releases are vulnerable.

The CVSS score of 6.5 indicates medium severity. The EPSS score is less than 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending an unauthenticated HTTP request to a token‑protected endpoint. No privileged local access is required, but the ability to authenticate as any user with an empty token presents a significant risk.