CVE-2025-58065: Flask-AppBuilder Authentication Bypass Vulnerability
Summary
CVE-2025-58065: Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods. Affects flask-appbuilder versions < 4.8.1. Fixed in 4.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flask-AppBuilder is a popular framework for building web applications in Python using Flask. It provides a rich set of features for building user interfaces, managing authentication, and integrating with various databases. The framework supports multiple authentication methods, including OAuth and LDAP, which allow developers to implement secure user management. However, a vulnerability has been identified that affects its handling of password reset functionalities when using non-database authentication methods.
Vulnerability Detail
The vulnerability arises when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods. In such cases, the password reset endpoint remains accessible even though it is not displayed in the user interface. This flaw allows enabled users to reset their passwords and create JWT tokens, even after being disabled on the authentication provider. This could lead to unauthorized access and potential exploitation of the application.
How To Fix
Minimum fixed version
4.8.1
This is the first release that contains the fix.
pip install --upgrade "flask-appbuilder==4.8.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing the following workarounds:
- Manually disable password reset routes in your application configuration.
- Add access controls at the web server or proxy level to block access to the password reset URL.
- Monitor for any suspicious password reset attempts from disabled accounts.
Conclusion
The Flask-AppBuilder vulnerability CVE-2025-58065 poses a significant risk when using non-database authentication methods. It is crucial to upgrade to the latest version or implement workarounds to secure your application against potential exploitation.
See every vulnerability recorded for flask-appbuilder →
FAQ
CVE-2025-58065 is a vulnerability in Flask-AppBuilder that allows authentication bypass when using non-database authentication methods.
This vulnerability can allow unauthorized users to reset passwords and gain access to JWT tokens, even if their accounts are disabled.
You can disable password reset routes in your configuration or implement access controls to mitigate the risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground without any signup.
The CVSS score for this vulnerability is 6.5, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for flask-appbuilder.
