# flask-appbuilder (PyPI) vulnerabilities

14 known vulnerabilities (1 critical, 3 high, 6 medium, 4 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pypi.org/project/flask-appbuilder/

## Advisories (14)

### [CVE-2025-58065](https://cve.now/CVE-2025-58065): Flask App Builder has an Authentication Bypass vulnerability when using non AUTH\_DB methods

- Severity: Medium 6.5
- Published: Sep 11, 2025
- Affected: fixed in 4.8.1.

### [CVE-2025-32962](https://cve.now/CVE-2025-32962): Flask-AppBuilder open redirect vulnerability using HTTP host injection

- Severity: Medium 4.3
- Published: May 16, 2025
- Affected: fixed in 4.6.2.

### [CVE-2025-24023](https://cve.now/CVE-2025-24023): Observable Response Discrepancy in flask-appbuilder

- Severity: Low 3.7
- Published: Mar 3, 2025
- Affected: fixed in 4.5.3.

### [CVE-2024-45314](https://cve.now/CVE-2024-45314): Flask-AppBuilder login form allows browser to cache sensitive fields

- Severity: Low 3.6
- Published: Sep 4, 2024
- Affected: fixed in 4.5.1.

### [CVE-2024-27083](https://cve.now/CVE-2024-27083): Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)

- Severity: Medium 4.3
- Published: Feb 28, 2024
- Affected: from 4.1.4, fixed in 4.2.1.

### [CVE-2024-25128](https://cve.now/CVE-2024-25128): Flask-AppBuilder incorrect authentication when using auth type OpenID

- Severity: Critical 9.1
- Published: Feb 28, 2024
- Affected: fixed in 4.3.11.

### [CVE-2023-34110](https://cve.now/CVE-2023-34110): Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error

- Severity: Low 2.7
- Published: Jun 22, 2023
- Affected: fixed in 4.3.2.

### [CVE-2023-29005](https://cve.now/CVE-2023-29005): No Rate Limiting on Login AUTH DB

- Severity: High 7.5
- Published: Apr 10, 2023
- Affected: fixed in 4.3.0.

### [CVE-2022-31177](https://cve.now/CVE-2022-31177): Possible to infer sensitive information through query strings in Flask-AppBuilder

- Severity: Low 2.7
- Published: Aug 1, 2022
- Affected: fixed in 4.1.3.

### [CVE-2022-24776](https://cve.now/CVE-2022-24776): Open Redirect in Flask-AppBuilder

- Severity: Medium 6.1
- Published: Mar 24, 2022
- Affected: fixed in 3.4.5.

### [CVE-2022-21659](https://cve.now/CVE-2022-21659): Observable Response Discrepancy in Flask-AppBuilder

- Severity: Medium 5.3
- Published: Jan 31, 2022
- Affected: fixed in 3.4.2; fixed in 3.4.4.

### [CVE-2021-41265](https://cve.now/CVE-2021-41265): Improper Authentication in Flask-AppBuilder

- Severity: High 8.1
- Published: Dec 9, 2021
- Affected: fixed in 3.3.4.

### [CVE-2021-32805](https://cve.now/CVE-2021-32805): URL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilder

- Severity: High 7.2
- Published: Sep 8, 2021
- Affected: fixed in 3.3.2.

### [CVE-2021-29621](https://cve.now/CVE-2021-29621): Observable Response Discrepancy in Flask-AppBuilder

- Severity: Medium 5.3
- Published: Jun 7, 2021
- Affected: fixed in 3.3.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/flask-appbuilder
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.