---
id: CVE-2021-23385
aliases:
  - GHSA-cg8c-gc2j-2wf7
  - PYSEC-2026-809
title: Flask-Security vulnerable to Open Redirect
summary: Flask-Security vulnerable to Open Redirect
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
vendor: flask-security
product: flask-security
ecosystem: pip
affected:
  - flask-security <= 3.0.0
published: '2022-10-07'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-cg8c-gc2j-2wf7'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-23385'
  - url: 'https://github.com/mattupstate/flask-security'
  - url: 'https://security.snyk.io/vuln/SNYK-PYTHON-FLASKSECURITY-1293234'
  - url: 'https://snyk.io/blog/url-confusion-vulnerabilities'
tags:
  - osv
  - pip
epss: 0.01147
epssPercentile: 0.65364
ingestedAt: '2026-07-08T18:25:48.372Z'
---

## Overview

This affects all versions of package Flask-Security. When using the `get_post_logout_redirect` and `get_post_login_redirect` functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as `\\\evil.com/path`. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using `'autocorrect_location_header=False`.

**Note:** Flask-Security is not maintained anymore.

## Affected packages

- `flask-security <= 3.0.0`

## Remediation

Refer to the advisory for the patched release.