CVE-2025-58065: Flask App Builder Authentication Bypass Vulnerability
Summary
CVE-2025-58065: Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods. Affects flask-appbuilder versions < 4.8.1. Fixed in 4.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flask App Builder is a popular framework for building web applications using Flask. It provides a robust set of features for managing user authentication, role-based access control, and database interactions. However, when configured to use non-database authentication methods such as OAuth or LDAP, it becomes susceptible to an authentication bypass vulnerability that can compromise user account security.
Vulnerability Detail
The vulnerability arises when Flask App Builder is set up to use authentication methods other than the database, such as OAuth or LDAP. In this configuration, the password reset endpoint remains active and accessible, even though it is not visible in the user interface. This flaw allows users, even if they are disabled in the authentication provider, to reset their passwords and generate JWT tokens, potentially leading to unauthorized access and account misuse.
How To Fix
Minimum fixed version
4.8.1
This is the first release that contains the fix.
pip install --upgrade "flask-appbuilder==4.8.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing the following workarounds:
- Manually disable password reset routes in your application configuration by adding the following line to your Flask app configuration: 'AUTH_DB = False'
- Set up additional access controls at the web server or proxy level to block access to the password reset URL.
- Monitor for any suspicious password reset attempts from accounts that should be disabled.
Conclusion
In summary, the Flask App Builder has a significant authentication bypass vulnerability when using non-database authentication methods. It is crucial to upgrade to the patched version or implement workarounds to protect your application from potential unauthorized access.
See every vulnerability recorded for flask-appbuilder →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a medium level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an upgrade is not possible, implement the suggested workarounds to mitigate the risk until you can update.
Failing to address this vulnerability may allow unauthorized users to reset passwords and gain access to sensitive data, leading to potential data breaches.
You can find more information about Flask App Builder on its official documentation page or GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for flask-appbuilder.
