Log in Start free

Vulnerability · Published Sep 11, 2025 · Assigned by GitHub_M

CVE-2025-58065Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods

Medium 6.5

In plain English

A medium-severity improper authentication in Flask-AppBuilder from dpgaspar. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 62.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. This allows an enabled user to reset their password and be able to create JWT tokens even after the user is disabled on the authentication provider. Users should upgrade to Flask-AppBuilder version 4.8.1 or later to receive a fix. If immediate upgrade is not possible, manually disable password reset routes in the application configuration; implement additional access controls at the web server or proxy level to block access to the reset my password URL; and/or monitor for suspicious password reset attempts from disabled accounts.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIflask-appbuilder4.8.1GHSA-765j-9r45-w2q2
PyPIflask-appbuilder4.8.1PYSEC-2026-1378

Affected products (as reported)

VendorProductVersions
dpgaspar Flask-AppBuilder < 4.8.1

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References