---
id: CVE-2025-24023
aliases:
  - GHSA-p8q5-cvwx-wvwp
  - PYSEC-2025-15
title: Flask-AppBuilder Observable Response Discrepancy
summary: Flask-AppBuilder Observable Response Discrepancy
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
vendor: flask-appbuilder
product: flask-appbuilder
ecosystem: pip
affected:
  - flask-appbuilder < 4.5.3
patched:
  - flask-appbuilder 4.5.3
published: '2025-03-03'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:48.433021837Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-p8q5-cvwx-wvwp'
references:
  - url: >-
      https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-p8q5-cvwx-wvwp
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-24023'
  - url: 'https://github.com/dpgaspar/Flask-AppBuilder'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/flask-appbuilder/PYSEC-2025-15.yaml
tags:
  - osv
  - pip
epss: 0.00325
epssPercentile: 0.2288
ingestedAt: '2026-09-12T03:13:01.715Z'
---

## Overview

### Impact
User enumeration in database authentication in Flask-AppBuilder <= 4.5.3 and werkzeug >= 3.0.0. Allows for a non authenticated user to enumerate existing usernames by timing the response time from the server when brute forcing requests to login.

### Patches

Upgrade to flask-appbuilder>=4.5.3

### Workarounds
Downgrade werkzeug to <3.0.0

### References
_Are there any links users can visit to find out more?_

## Affected packages

- `flask-appbuilder < 4.5.3`

## Remediation

Upgrade to a patched release:

- `flask-appbuilder 4.5.3`