CVE-2021-32805 URL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilder

What is CVE-2021-32805?

CVE-2021-32805 is a high-severity vulnerability in dpgaspar Flask-AppBuilder, published on 8 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Flask-AppBuilder is an application development framework, built on top of Flask. In affected versions if using Flask-AppBuilder OAuth, an attacker can share a carefully crafted URL with a trusted domain for an application built with Flask-AppBuilder, this URL can redirect a user to a malicious site. This is an open redirect vulnerability. To resolve this issue upgrade to Flask-AppBuilder 3.2.2 or above. If upgrading is infeasible users may filter HTTP traffic containing `?next={next-site}` where the `next-site` domain is different from the application you are protecting as a workaround.

Weakness: CWE-601

Which versions are affected by CVE-2021-32805?

3 open source packages ship an affected version, including flask-appbuilder and Flask-AppBuilder. It affects 1 product.

Products include Dpgaspar Flask-Appbuilder.

How do I fix CVE-2021-32805?

Upgrade flask-appbuilder to 3.3.2 or later.

Is CVE-2021-32805 being exploited?

There is no known exploitation of CVE-2021-32805 in the wild and no public exploit code.

Other vulnerabilities in dpgaspar Flask-AppBuilder

• CVE-2024-25128 Flask-AppBuilder incorrect authentication when using auth type OpenID Critical 9.1
• CVE-2021-41265 Improper Authentication in Flask-AppBuilder High 8.1
• CVE-2023-29005 No Rate Limiting on Login AUTH DB High 7.5
• CVE-2025-58065 Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods Medium 6.5
• CVE-2022-24776 Open Redirect in Flask-AppBuilder Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-624f-cqvr-3qw4, PYSEC-2021-359.