The vulnerability is in Flask‑Security‑Too's OAuth reauthentication flow, in version 5.8.0. An attacker who already controls a victim’s stale, authenticated session can trigger reauthentication and bind an OAuth identity that belongs to another user. The workflow then marks the session as fresh, allowing actions that require a recent authentication to proceed. This allows the attacker to perform privileged operations on the victim’s account, compromising sensitive data or escalating privileges. The weakness is a broken authentication flow (CWE‑287).

Versions of Flask‑Security‑Too up to and including 5.8.0 are affected. A patch was introduced in 5.8.1 to prevent cross‑user OAuth identity acceptance during reauthentication.

With a CVSS score of 5.3 the issue is of moderate severity. EPSS score is <1%, indicating a very low yet nonzero exploitation probability and the vulnerability is not listed in CISA KEV, indicating no known public exploitation yet. Exploitation requires the attacker to control a victim’s stale session and to trigger a reauthentication flow with a different OAuth account. While the likelihood of widespread attack is moderate, the impact on affected accounts can be significant if an attacker succeeds.