{"cve":"CVE-2025-58065","nvd":{"published":"2025-09-11T18:15:35.170","modified":"2026-06-17T09:43:51.910","status":"Analyzed","description":"Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. This allows an enabled user to reset their password and be able to create JWT tokens even after the user is disabled on the authentication provider. Users should upgrade to Flask-AppBuilder version 4.8.1 or later to receive a fix. If immediate upgrade is not possible, manually disable password reset routes in the application configuration; implement additional access controls at the web server or proxy level to block access to the reset my password URL; and/or monitor for suspicious password reset attempts from disabled accounts.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","score":6.5},"cwes":["CWE-287"],"references":["https://github.com/dpgaspar/Flask-AppBuilder/commit/a942a9cc5775752f9a02f97fd8198dd288fa93ee","https://github.com/dpgaspar/Flask-AppBuilder/pull/2384","https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v4.8.1","https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-765j-9r45-w2q2"],"products":["dpgaspar:flask-appbuilder"],"source":"nvd","synced_at":"2026-10-19T22:08:41.295252406+00:00"},"epss":{"cve":"CVE-2025-58065","score":0.00433,"percentile":0.37587,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-765j-9r45-w2q2","url":"https://osv.dev/vulnerability/GHSA-765j-9r45-w2q2","summary":"Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods","modified":"2026-09-10T03:50:27.976836411Z","packages":[{"ecosystem":"PyPI","name":"flask-appbuilder","purl":"pkg:pypi/flask-appbuilder","ranges":["<4.8.1"],"fixed":["4.8.1"]}]},{"id":"PYSEC-2026-1378","url":"https://osv.dev/vulnerability/PYSEC-2026-1378","summary":"Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods","modified":"2026-07-07T17:47:36.750744745Z","packages":[{"ecosystem":"PyPI","name":"flask-appbuilder","purl":"pkg:pypi/flask-appbuilder","ranges":["<4.8.1"],"fixed":["4.8.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}