PYSEC-2026-809 Flask-Security vulnerable to Open Redirect

This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only...

PT-2022-9396

Name of the Vulnerable Software and Affected Versions Flask-Security versions all Description This issue allows an attacker to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes. The vulnerability is only exploitable if an alternative WSGI server othe...