---
id: CVE-2022-24776
aliases:
  - GHSA-2ccw-7px8-vmpf
  - PYSEC-2026-635
title: Open Redirect in Flask-AppBuilder
summary: Open Redirect in Flask-AppBuilder
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
vendor: flask-appbuilder
product: flask-appbuilder
ecosystem: pip
affected:
  - flask-appbuilder < 3.4.5
patched:
  - flask-appbuilder 3.4.5
published: '2022-03-25'
updated: '2026-07-06'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-2ccw-7px8-vmpf'
references:
  - url: >-
      https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-2ccw-7px8-vmpf
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-24776'
  - url: 'https://github.com/dpgaspar/Flask-AppBuilder/pull/1804'
  - url: >-
      https://github.com/dpgaspar/Flask-AppBuilder/pull/1804/commits/5214d975ebad2ff32057443d2cc20fef1c04d0ea
  - url: 'https://github.com/dpgaspar/Flask-AppBuilder'
  - url: 'https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.4.5'
tags:
  - osv
  - pip
epss: 0.00968
epssPercentile: 0.60194
ingestedAt: '2026-07-08T18:25:44.204Z'
---

## Overview

Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 3.4.5 contain an open redirect vulnerability when using the database authentication login page. There are no known workarounds. Users are recommended to upgrade to version 3.4.5 or later.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Flask-AppBuilder](https://github.com/dpgaspar/Flask-AppBuilder)


## Affected packages

- `flask-appbuilder < 3.4.5`

## Remediation

Upgrade to a patched release:

- `flask-appbuilder 3.4.5`