---
id: CVE-2024-45314
aliases:
  - GHSA-fw5r-6m3x-rh7p
  - PYSEC-2026-1382
title: 'Flask-AppBuilder''s login form allows browser to cache sensitive fields '
summary: 'Flask-AppBuilder''s login form allows browser to cache sensitive fields '
severity: low
cvss: 3.6
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N'
vendor: flask-appbuilder
product: flask-appbuilder
ecosystem: pip
affected:
  - flask-appbuilder < 4.5.1
patched:
  - flask-appbuilder 4.5.1
published: '2024-09-04'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:18.804280445Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-fw5r-6m3x-rh7p'
references:
  - url: >-
      https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-fw5r-6m3x-rh7p
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-45314'
  - url: >-
      https://github.com/dpgaspar/Flask-AppBuilder/commit/3030e881d2e44f4021764e18e489fe940a9b3636
  - url: 'https://github.com/dpgaspar/Flask-AppBuilder'
tags:
  - osv
  - pip
epss: 0.00265
epssPercentile: 0.18661
ingestedAt: '2026-07-08T18:25:49.141Z'
---

## Overview

### Impact
Auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources.

### Patches
Upgrade flask-appbuilder to version 4.5.1

### Workarounds
If upgrading is not possible configure your web server to send the following HTTP headers for /login:
"Cache-Control": "no-store, no-cache, must-revalidate, max-age=0"
"Pragma": "no-cache"
"Expires": "0" 


## Affected packages

- `flask-appbuilder < 4.5.1`

## Remediation

Upgrade to a patched release:

- `flask-appbuilder 4.5.1`