CVE-2025-58065Medium· 6.5▾ SunlitFlask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.4%
0.4% → 0.4%
Last analysed / modified upstream
When Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. This allows an enabled user to reset their password and be able to create JWT tokens even after the user is disabled on the authentication provider.
Upgrade to Flask-AppBuilder version 4.8.1 or later
If immediate upgrade is not possible:
flask-appbuilder < 4.8.1Upgrade to a patched release:
flask-appbuilder 4.8.1Connected by shared product, vendor, weakness, or advisory.
CVE-2022-21659Medium· 5.3Observable Response Discrepancy in Flask-AppBuilder
CVE-2025-24023Low· 3.7Flask-AppBuilder Observable Response Discrepancy
CVE-2024-25128Critical· 9.1Flask-AppBuilder vulnerable to incorrect authentication when using auth type OpenID
CVE-2021-41265High· 8.1Improper Authentication in Flask-AppBuilder
CVE-2024-45314Low· 3.6Flask-AppBuilder's login form allows browser to cache sensitive fields
CVE-2024-27083Medium· 4.3Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)