---
id: CVE-2022-21659
aliases:
  - GHSA-wfjw-w6pv-8p7f
  - PYSEC-2022-24
title: Observable Response Discrepancy in Flask-AppBuilder
summary: Observable Response Discrepancy in Flask-AppBuilder
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
vendor: flask-appbuilder
product: flask-appbuilder
ecosystem: pip
affected:
  - flask-appbuilder < 3.4.4
patched:
  - flask-appbuilder 3.4.4
published: '2022-02-01'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:12.893858485Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-wfjw-w6pv-8p7f'
references:
  - url: >-
      https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-wfjw-w6pv-8p7f
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-21659'
  - url: 'https://github.com/dpgaspar/Flask-AppBuilder/pull/1775'
  - url: >-
      https://github.com/dpgaspar/Flask-AppBuilder/commit/e2b744c258ff62ece9d5ac7172c3b4644ff4c2fe
  - url: 'https://github.com/dpgaspar/Flask-AppBuilder'
  - url: 'https://github.com/dpgaspar/Flask-AppBuilder/commits/v3.4.4'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/flask-appbuilder/PYSEC-2022-24.yaml
tags:
  - osv
  - pip
epss: 0.00953
epssPercentile: 0.59849
ingestedAt: '2026-09-12T03:13:01.735Z'
---

## Overview

### Impact
User enumeration in database authentication in Flask-AppBuilder  < 3.4.4. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in.

### Patches
Upgrade to 3.4.4

### Workarounds

### References

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [example link to repo](http://example.com)
* Email us at [example email address](mailto:example@example.com)

## Affected packages

- `flask-appbuilder < 3.4.4`

## Remediation

Upgrade to a patched release:

- `flask-appbuilder 3.4.4`