{"id":"CVE-2025-32962","aliases":["GHSA-99pm-ch96-ccp2","PYSEC-2026-1379"],"title":"Flask-AppBuilder open redirect vulnerability using HTTP host injection","summary":"Flask-AppBuilder open redirect vulnerability using HTTP host injection","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","vendor":"flask-appbuilder","product":"flask-appbuilder","ecosystem":"pip","affected":["flask-appbuilder < 4.6.2"],"patched":["flask-appbuilder 4.6.2"],"published":"2025-05-16","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:57.462278194Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-99pm-ch96-ccp2","references":[{"url":"https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-99pm-ch96-ccp2"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32962"},{"url":"https://github.com/dpgaspar/Flask-AppBuilder/commit/32eedbbb5cb483a3e782c5f2732de4a6a650d9b6"},{"url":"https://github.com/dpgaspar/Flask-AppBuilder"}],"tags":["osv","pip"],"epss":0.0022,"epssPercentile":0.12771,"ingestedAt":"2026-07-08T18:25:47.806Z","slug":"CVE-2025-32962","body":"## Overview\n\n### Impact\nFlask-AppBuilder prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests.\n \n### Patches\nFlask-AppBuilder 4.6.2 introduced the `FAB_SAFE_REDIRECT_HOSTS` configuration variable, which allows administrators to explicitly define which domains are considered safe for redirection.\n\nExamples:\n```\nFAB_SAFE_REDIRECT_HOSTS = [\"yourdomain.com\", \"sub.yourdomain.com\", \"*.yourcompany.com\"]\n```\n\n### Workarounds\nUse a Reverse Proxy to Enforce Trusted Host Headers\n\n### References\n_Are there any links users can visit to find out more?_\n\n## Affected packages\n\n- `flask-appbuilder < 4.6.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `flask-appbuilder 4.6.2`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}