---
id: CVE-2023-29005
aliases:
  - GHSA-9hcr-9hcv-x6pv
  - PYSEC-2026-1380
title: Flask-AppBuilder Has No Rate Limiting on Login AUTH DB
summary: Flask-AppBuilder Has No Rate Limiting on Login AUTH DB
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
vendor: flask-appbuilder
product: flask-appbuilder
ecosystem: pip
affected:
  - flask-appbuilder < 4.3.0
patched:
  - flask-appbuilder 4.3.0
published: '2023-04-10'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-9hcr-9hcv-x6pv'
references:
  - url: >-
      https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-9hcr-9hcv-x6pv
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-29005'
  - url: 'https://github.com/dpgaspar/Flask-AppBuilder/pull/1976'
  - url: 'https://flask-limiter.readthedocs.io/en/stable/configuration.html'
  - url: 'https://github.com/dpgaspar/Flask-AppBuilder'
  - url: 'https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v4.3.0'
tags:
  - osv
  - pip
epss: 0.00629
epssPercentile: 0.4877
ingestedAt: '2026-07-08T18:25:48.009Z'
---

## Overview

### Impact
Lack of rate limiting will allow an attacker to brute-force user credentials.

### Patches
Ability to enable rate limiting on Flask-AppBuilder >=  4.3.0. Use `AUTH_RATE_LIMITED = True` and `RATELIMIT_ENABLED = True` set the limit itself by using `AUTH_RATE_LIMIT`. Will apply only to database authentication.

### Workarounds
Implement rate limiting using a reverse proxy or other strategies.

## Affected packages

- `flask-appbuilder < 4.3.0`

## Remediation

Upgrade to a patched release:

- `flask-appbuilder 4.3.0`