{"id":"CVE-2023-29005","aliases":["GHSA-9hcr-9hcv-x6pv","PYSEC-2026-1380"],"title":"Flask-AppBuilder Has No Rate Limiting on Login AUTH DB","summary":"Flask-AppBuilder Has No Rate Limiting on Login AUTH DB","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","vendor":"flask-appbuilder","product":"flask-appbuilder","ecosystem":"pip","affected":["flask-appbuilder < 4.3.0"],"patched":["flask-appbuilder 4.3.0"],"published":"2023-04-10","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-9hcr-9hcv-x6pv","references":[{"url":"https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-9hcr-9hcv-x6pv"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29005"},{"url":"https://github.com/dpgaspar/Flask-AppBuilder/pull/1976"},{"url":"https://flask-limiter.readthedocs.io/en/stable/configuration.html"},{"url":"https://github.com/dpgaspar/Flask-AppBuilder"},{"url":"https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v4.3.0"}],"tags":["osv","pip"],"epss":0.00629,"epssPercentile":0.4845,"ingestedAt":"2026-07-08T18:25:48.009Z","slug":"CVE-2023-29005","body":"## Overview\n\n### Impact\nLack of rate limiting will allow an attacker to brute-force user credentials.\n\n### Patches\nAbility to enable rate limiting on Flask-AppBuilder >=  4.3.0. Use `AUTH_RATE_LIMITED = True` and `RATELIMIT_ENABLED = True` set the limit itself by using `AUTH_RATE_LIMIT`. Will apply only to database authentication.\n\n### Workarounds\nImplement rate limiting using a reverse proxy or other strategies.\n\n## Affected packages\n\n- `flask-appbuilder < 4.3.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `flask-appbuilder 4.3.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}