CVE-2025-32962: Flask-AppBuilder Open Redirect Vulnerability via HTTP Host Injection
Summary
CVE-2025-32962: Flask-AppBuilder open redirect vulnerability using HTTP host injection. Affects flask-appbuilder versions < 4.6.2. Fixed in 4.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flask-AppBuilder is a popular framework for building web applications in Python, designed to facilitate the development of data-driven applications. It provides a robust set of features including user authentication, role-based access control, and a customizable UI. However, prior to version 4.6.2, Flask-AppBuilder was susceptible to an open redirect vulnerability, allowing attackers to manipulate HTTP host headers.
Vulnerability Detail
The vulnerability arises from the lack of proper validation of the Host header in HTTP requests. An unauthenticated attacker could exploit this weakness to redirect users to malicious sites, potentially leading to phishing attacks or other security breaches. This issue is particularly concerning as it affects the integrity of user navigation within applications built on Flask-AppBuilder.
How To Fix
Minimum fixed version
4.6.2
This is the first release that contains the fix.
pip install --upgrade "flask-appbuilder==4.6.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can use a reverse proxy to enforce trusted host headers, ensuring that only legitimate requests are processed. This can help mitigate the risk of open redirects until the package is updated.
Conclusion
In summary, the open redirect vulnerability in Flask-AppBuilder prior to version 4.6.2 poses a significant risk to applications built using this framework. It is crucial for developers and administrators to update to the latest version and implement the recommended configurations to safeguard against potential exploitation.
See every vulnerability recorded for flask-appbuilder →
FAQ
It is an open redirect vulnerability that allows attackers to manipulate the Host header in HTTP requests.
You can check if your application is affected by using the Vulert playground at Vulert Scanner without any signup.
The vulnerability can lead to phishing attacks, where users are redirected to malicious sites, compromising their data and security.
Yes, upgrading to Flask-AppBuilder version 4.6.2 or later addresses this vulnerability.
The CVSS score of this vulnerability is 4.3, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for flask-appbuilder.
