---
id: CVE-2024-27083
aliases:
  - GHSA-fqxj-46wg-9v84
  - PYSEC-2026-1381
title: Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)
summary: Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'
vendor: flask-appbuilder
product: flask-appbuilder
ecosystem: pip
affected:
  - 'flask-appbuilder >= 4.1.4, < 4.2.1'
patched:
  - flask-appbuilder 4.2.1
published: '2024-02-28'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:06.227675631Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-fqxj-46wg-9v84'
references:
  - url: >-
      https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-fqxj-46wg-9v84
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-27083'
  - url: >-
      https://github.com/dpgaspar/Flask-AppBuilder/commit/3d17741886e4b3c384d0570de69689e4117aa812
  - url: 'https://github.com/dpgaspar/Flask-AppBuilder'
tags:
  - osv
  - pip
epss: 0.00567
epssPercentile: 0.44627
ingestedAt: '2026-07-08T18:25:49.110Z'
---

## Overview

### Impact
A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser.

Impacted versions:
Flask-AppBuilder version 4.1.4 up to and including 4.2.0

### Patches
This issue was introduced on 4.1.4 and patched on 4.2.1, user's should upgrade to 4.2.1 or newer versions.

## Affected packages

- `flask-appbuilder >= 4.1.4, < 4.2.1`

## Remediation

Upgrade to a patched release:

- `flask-appbuilder 4.2.1`