Critical severity9.1NVD Advisory· Published Feb 29, 2024· Updated Jun 17, 2026
CVE-2024-25128
CVE-2024-25128
Description
Flask-AppBuilder is an application development framework, built on top of Flask. When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, it allows an attacker to forge an HTTP request, that could deceive the backend into using any requested OpenID service. This vulnerability could grant an attacker unauthorised privilege access if a custom OpenID service is deployed by the attacker and accessible by the backend. This vulnerability is only exploitable when the application is using the OpenID 2.0 authorization protocol. Upgrade to Flask-AppBuilder 4.3.11 to fix the vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
Flask-AppBuilderPyPI | < 4.3.11 | 4.3.11 |
Affected products
3cpe:2.3:a:dpgaspar:flask-appbuilder:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:dpgaspar:flask-appbuilder:*:*:*:*:*:*:*:*range: <4.3.11
- (no CPE)range: < 4.3.11
Patches
Vulnerability mechanics
References
4- github.com/dpgaspar/Flask-AppBuilder/commit/6336456d83f8f111c842b2b53d1e89627f2502c8nvdPatchWEB
- github.com/advisories/GHSA-j2pw-vp55-fqqjghsaADVISORY
- github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-j2pw-vp55-fqqjnvdMitigationVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2024-25128ghsaADVISORY
News mentions
0No linked articles in our index yet.