Engineering notes from the trenches.

Flask-Security-Too OAuth Freshness Bypass: When Verifying the Wrong User Still Counts

CVE analysis of Flask-Security-Too 5.8.0's OAuth reauthentication bypass where verifying a different user's OAuth identity marks the session as fresh, enabling privilege escalation.