CVE-2025-24023

CVE-2025-24023 affects Flask-AppBuilder prior to 4.5.3, where unauthenticated users can enumerate existing usernames by timing the login request response. This timing discrepancy constitutes a partial information disclosure vulnerability with low to medium impact as described in multiple sources....

CVE-2024-45314

CVE-2024-45314 affects Flask-AppBuilder: the auth DB login form allows the browser to cache sensitive data. Affected component is the login form; root cause is default cache directives exposing data in shared environments. Version 4.5.1 fixes the issue. If upgrading is not possible, a workaround ...

CVE-2025-32962

CVE-2025-32962 affects Flask-AppBuilder before 4.6.2. An unauthenticated attacker can trigger an open redirect by manipulating the HTTP Host header. The root cause is insufficient validation of redirect targets. The advisory notes that Flask-AppBuilder 4.6.2 introduces the FAB_SAFE_REDIRECT_HOSTS...

CVE-2024-25128

Flask-AppBuilder (FAB) is affected when AUTH_TYPE is set to AUTH_OID. The vulnerability allows forging an HTTP request to trick the backend into using an attacker-controlled OpenID service, potentially granting unauthorized privilege access. The issue is exploitable with OpenID 2.0 and is mitigat...

CVE-2024-27083

CVE-2024-27083 affects Flask-AppBuilder. An XSS on the OAuth login page was introduced in 4.1.4 and fixed in 4.2.1. Impact is on the OAuth login flow where crafted URLs can execute JavaScript in the user’s browser. Affected versions: 4.1.4 through 4.2.0; remediation: upgrade to 4.2.1 or newer. Ex...

CVE-2023-29005

Affected software: Flask-AppBuilder before 4.3.0. Root cause: lack of rate limiting on login allows brute-forcing credentials. Mitigation: upgrade to Flask-AppBuilder 4.3.0 or later; in 4.3.0+, enable rate limiting via AUTH_RATE_LIMITED = True, RATELIMIT_ENABLED = True, and set AUTH_RATE_LIMIT. S...

CVE-2022-31177

CVE-2022-31177 affects Flask-AppBuilder versions prior to 4.1.3. An authenticated Admin could query other users by their salted and hashed password strings using partial hashed password strings. The server would not return full hashes, but an attacker could infer partial password hashes and their...

CVE-2021-29621

The vulnerability is in Flask-AppBuilder (a Flask-based development framework). A user-enumeration flaw exists in the database authentication flow, where an unauthenticated user can infer existing accounts by measuring login response timing. Affected versions are Flask-AppBuilder

CVE-2025-58065

CVE-2025-58065 (Flask-AppBuilder) : Prior to v4.8.1, when using non-database authentication (OAuth/LDAP, etc.), the password reset endpoint remains registered and accessible even if not shown in the UI. This can let an enabled user reset their password and obtain JWTs, potentially bypassing deact...

CVE-2022-21659

CVE-2022-21659 refers to a timing-based user enumeration vulnerability in Flask-AppBuilder (pre-3.4.4). The issue allows an unauthenticated user to infer account existence by measuring login response timing, indicating a partial confidentiality impact. Affected software is Flask-AppBuilder built ...

CVE-2022-24776

Flask-AppBuilder

CVE-2021-32805

CVE-2021-32805 describes an open redirect in Flask-AppBuilder when using OAuth. Vulnerable in affected Flask-AppBuilder deployments that accept a crafted URL to redirect users to a malicious site. Remediation listed: upgrade Flask-AppBuilder to 3.2.2+ or apply a workaround that filters next param...

CVE-2021-41265

CVE-2021-41265 affects Flask-AppBuilder prior to 3.3.4, due to an improper authentication vulnerability in the REST API. The issue allows a malicious actor to authenticate with a crafted request and access protected REST API endpoints, limited to non-database authentication types and new REST API...