CVE-2022-24776Medium· 6.1▾ SunlitOpen Redirect in Flask-AppBuilder
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.9%
0.9% → 1.0%
Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 3.4.5 contain an open redirect vulnerability when using the database authentication login page. There are no known workarounds. Users are recommended to upgrade to version 3.4.5 or later.
If you have any questions or comments about this advisory:
flask-appbuilder < 3.4.5Upgrade to a patched release:
flask-appbuilder 3.4.5Connected by shared product, vendor, weakness, or advisory.
CVE-2022-21659Medium· 5.3Observable Response Discrepancy in Flask-AppBuilder
CVE-2025-24023Low· 3.7Flask-AppBuilder Observable Response Discrepancy
CVE-2024-25128Critical· 9.1Flask-AppBuilder vulnerable to incorrect authentication when using auth type OpenID
CVE-2021-41265High· 8.1Improper Authentication in Flask-AppBuilder
CVE-2024-45314Low· 3.6Flask-AppBuilder's login form allows browser to cache sensitive fields
CVE-2024-27083Medium· 4.3Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)