CVE-2025-47278
lowpriority · track · 0EPSS 0.002 · 9 %ileEUUSEPSS · scored 2026-10-27
Flask is a web server gateway interface (WSGI) web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the `itsdangerous` library. A list of keys can be passed, and it expects the last (top) key in the list to be the most recent key, and uses that for signing. Flask was incorrectly constructing that list in reverse, passing the signing key first. Sites that have opted-in to use key rotation by setting `SECRET_KEY_FALLBACKS` care likely to unexpectedly be signing their sessions with stale keys, and their transition to fresher keys will be impeded. Sessions are still signed, so this would not cause any sort of data integrity loss. Version 3.1.1 contains a patch for the issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-4grg-w6v8-c28gFlask uses fallback key instead of current signing key2025-05-13ghsa · osvUS
In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the `itsdangerous` library. A list of keys can be passed, and it expects the last (top) key in the list to be the most recent key, and uses that for signing. Flask was incorrectly constructing that list in reverse, passing the signing key first. Sites that have opted-in to use key rotation by setting `SECRET_KEY_FALLBACKS` are likely to unexpectedly be signing their sessions with stale keys, and their transition to fresher keys will be impeded. Sessions are still signed, so this would not cause any sort of data integrity loss.
- PYSEC-2026-1377Flask uses fallback key instead of current signing key2026-07-07vendor · osvUS
In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the `itsdangerous` library. A list of keys can be passed, and it expects the last (top) key in the list to be the most recent key, and uses that for signing. Flask was incorrectly constructing that list in reverse, passing the signing key first. Sites that have opted-in to use key rotation by setting `SECRET_KEY_FALLBACKS` are likely to unexpectedly be signing their sessions with stale keys, and their transition to fresher keys will be impeded. Sessions are still signed, so this would not cause any sort of data integrity loss.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://github.com/pallets/flask/commit/73d6504063bfa00666a92b07a28aaf906c532f09cnnvd
- https://github.com/pallets/flask/releasesPatchcnnvd
- https://github.com/pallets/flask/releases/tag/3.1.1cnnvd
- https://github.com/pallets/flask/security/advisories/GHSA-4grg-w6v8-c28gcnnvd
- https://vigilance.fr/vulnerability/Flask-denial-of-service-via-Fallback-Key-Configuration-47269cnnvd
- https://github.com/pallets/flask/commit/73d6504063bfa00666a92b07a28aaf906c532f09enisa_euvd
- https://github.com/pallets/flask/releases/tag/3.1.1enisa_euvd
- https://github.com/pallets/flask/security/advisories/GHSA-4grg-w6v8-c28genisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan