Flask uses fallback key instead of current signing key

In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key.Signing is provided by the itsdangerous library. A list of keys can be passed, and it expects the last top key in the list to be the most...

Flask-AppBuilder open redirect vulnerability using HTTP host injection

ImpactFlask-AppBuilder prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. PatchesFlask-AppBuilder 4.6.2 introduced the FABSAFEREDIRECTHOSTS configuration variable, which allows administrators to explicitly...

aglow (>=0.1.0rc3, <=0.1.0rc4), ai-flow (0.3.1) +6 more potentially affected by CVE-2025-32962 via flask-appbuilder (3.1.1)

flask-appbuilder PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - aglow =0.1.0rc3, =2022.9.19, =2.0.0b1, =1.4.0, =2.0.4 - dataverk-airflow 0.3.12 - gps-building-blocks 1.2.2 - neuro-airflow-plug...

apache-airflow (>=1.10.3b1, <=1.10.3), dag-manager (>=0.1.3a0, <=0.1.5a0) +3 more potentially affected by CVE-2025-32962 via flask-appbuilder (1.12.3)

flask-appbuilder PYPI version 1.12.3 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - apache-airflow =1.10.3b1, =0.1.3a0, =0.5.4rc0, =0.1.0, =3.0.2, =3.0.3 Source cves: CVE-2025-32962 Source advisory:...

doc-tour (>=0.1.2, <=0.1.4) potentially affected by CVE-2025-32962 via flask-appbuilder (2.2.2)

flask-appbuilder PYPI version 2.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - doc-tour =0.1.2, =0.1.4 Source cves: CVE-2025-32962 Source advisory: OSV:PYSEC-2026-1379...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), airflow-docker (>=1.0.0, <=1.1.0) +5 more potentially affected by CVE-2025-32962 via flask-appbuilder (1.13.1)

flask-appbuilder PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - airflow-clickhouse-plugin =0.5.1, =1.0.0, =1.10.0, =1.10.4b2, =1.10.6 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24....

airflow-aggua-plugin (>=1.0.7, <=1.0.8), airflow-clickhouse-plugin (>=0.5.6, <=0.5.7.post1) +97 more potentially affected by CVE-2025-32962 via flask-appbuilder (2.3.4)

flask-appbuilder PYPI version 2.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - airflow-aggua-plugin =1.0.7, =0.5.6, =0.1.0, =0.0.7, =0.0.1, =0.1.6, =0.0.2, =1.0.0, =1.10.7rc1, =2020.5.20rc1, =2021.2.5rc1,...

PYSEC-2026-1379 Flask-AppBuilder open redirect vulnerability using HTTP host injection

Impact Flask-AppBuilder prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Patches Flask-AppBuilder 4.6.2 introduced the FABSAFEREDIRECTHOSTS configuration variable, which allows administrators to explicit...

apache-airflow (>=2.2.4rc1, <=2.2.5rc2), apilogicserver (>=5.2.15, <=5.3.33) potentially affected by CVE-2025-32962 via flask-appbuilder (3.4.4)

flask-appbuilder PYPI version 3.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - apache-airflow =2.2.4rc1, =5.2.15, =5.3.33 Source cves: CVE-2025-32962 Source advisory: OSV:PYSEC-2026-1379...

abi-ds-utils (1.0.1), acceldata-o2a (1.0.0) +134 more potentially affected by CVE-2025-32962 via flask-appbuilder (>=4.1.2, <=4.5.4)

flask-appbuilder PYPI version =4.1.2, =0.9.5.1rc1, =1.4.0.3.post4, =1.4.0.3.post3, =0.2.1, =0.4.0, =0.1.0a1, =0.8.2, =0.1.1, =0.1.1, =1.10.6 - airflow-cyberark-secrets-backend 0.1.0 - airflow-dagfactory 0.19.1 and more Source cves: CVE-2025-32962 Source advisory: OSV:PYSEC-2026-1379...

PYSEC-2026-1377 Flask uses fallback key instead of current signing key

In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can be passed, and it expects the last top key in the list to be the most...

adminui2 (1.5.6), altspell (>=0.1.0, <=0.4.0) +139 more potentially affected by CVE-2025-47278 via flask (3.1.0)

flask PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - adminui2 1.5.6 - altspell =0.1.0, =0.0.1, =0.1.0, =1740736363.0.0, =1.0.2, =1.0.0, =1.0.0, =1.6.0, =1.7.5 and more Source cves: CVE-2025-47278 Source...

astaligner (>=0.1.0, <=1.0.2), cacaodocs (>=0.1.3, <=0.1.14) +30 more potentially affected by CVE-2024-6866 via flask-cors (5.0.0)

flask-cors PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - astaligner =0.1.0, =0.1.3, =0.1.0, =1.0.0a0, =0.1.0, =1.0.0, =1.5.8, =0.1.0, =0.0.10, =3.11.44, =3.3.4, =0.0.1, =0.0.3 and more Source cves:...

PYSEC-2026-1384 Flask-CORS improper regex path matching vulnerability

corydolphin/flask-cors version 5.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex...

PYSEC-2026-1383 Flask-CORS vulnerable to Improper Handling of Case Sensitivity

corydolphin/flask-cors version 5.0.1 contains a vulnerability where the request path matching is case-insensitive due to the use of the trymatch function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching...

ag-llama-api (>=0.0.1, <=0.0.31), ag-llama-api-s (>=0.0.4, <=0.0.12) +298 more potentially affected by CVE-2024-6844 via flask-cors (3.0.10)

flask-cors PYPI version 3.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - ag-llama-api =0.0.1, =0.0.4, =0.0.13, =1.0.2, =2.5.0, =2.5.0, =0.1.0b2696.post0.dev1, =0.1.8, =0.0.1, =1.0.2, =1.0.1, =4.1.0, =3.4.0, =4.0....

abstra (>=1.8.8, <=2.5.1), adeso (>=0.0.1, <=0.0.4) +70 more potentially affected by CVE-2024-6844 via flask-cors (4.0.0)

flask-cors PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - abstra =1.8.8, =0.0.1, =0.0.1, =0.0.6.dev1, =0.1.2, =0.0.7, =0.2.18, =0.1.0, =51.9.7, =0.0.25, =0.0.10, =0.0.12 and more Source cves:...

astaligner (>=0.1.0, <=1.0.2), cacaodocs (>=0.1.3, <=0.1.14) +30 more potentially affected by CVE-2024-6844 via flask-cors (5.0.0)

flask-cors PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - astaligner =0.1.0, =0.1.3, =0.1.0, =1.0.0a0, =0.1.0, =1.0.0, =1.5.8, =0.1.0, =0.0.10, =3.11.44, =3.3.4, =0.0.1, =0.0.3 and more Source cves:...

aact-openhands (>=0.0.4, <=0.0.5), agent-actions (>=0.1.0, <=0.1.8) +61 more potentially affected by CVE-2024-6844 via flask-cors (4.0.2)

flask-cors PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - aact-openhands =0.0.4, =0.1.0, =1.1.0b2, =1.0.4, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =2.42.0, =0.1.0, =0.1.3 - cornflow 1.3.1rc2 and more Source...

agentic-ai-vass-tools (>=0.1.0, <=0.4.0), altspell (>=0.1.0, <=0.4.0) +39 more potentially affected by CVE-2024-6844 via flask-cors (5.0.1)

flask-cors PYPI version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - agentic-ai-vass-tools =0.1.0, =0.1.0, =0.21.0, =1.3.3, =0.2.0, =4.21.0b8, =1.7.0, =0.2.4, =0.1.0, =0.1.1, =3.13.7, =3.16.1 and more Source...