cve.bz

CVE-2025-32962

6.1 mediumEPSS 0.2%

Medium (6.1) in dpgaspar flask-appbuilder. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in flask-appbuilder 4.6.2.

Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the `FAB_SAFE_REDIRECT_HOSTS` configuration variable, which allows administrators to explicitly define which domains are considered safe for redirection. As a workaround, use a reverse proxy to enforce trusted host headers.

Severity

CVSS 3.1

6.1 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-31)
CWE
CWE-601
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-99pm-ch96-ccp2PyPIflask-appbuilder<4.6.24.6.2
PYSEC-2026-1379PyPIflask-appbuilder<4.6.24.6.2

References

Check your stackJSON