CVE-2022-24776 Open Redirect in Flask-AppBuilder

What is CVE-2022-24776?

CVE-2022-24776 is a medium-severity vulnerability in dpgaspar Flask-AppBuilder, published on 24 Mar 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Flask-AppBuilder is an application development framework, built on top of the Flask web framework. Flask-AppBuilder contains an open redirect vulnerability when using database authentication login page on versions below 3.4.5. This issue is fixed in version 3.4.5. There are currently no known workarounds.

Weakness: CWE-601

Which versions are affected by CVE-2022-24776?

3 open source packages ship an affected version, including flask-appbuilder and Flask-AppBuilder. It affects 1 product.

Products include Dpgaspar Flask-Appbuilder.

How do I fix CVE-2022-24776?

Upgrade flask-appbuilder to 3.4.5 or later.

Is CVE-2022-24776 being exploited?

There is no known exploitation of CVE-2022-24776 in the wild and no public exploit code.

Other vulnerabilities in dpgaspar Flask-AppBuilder

• CVE-2024-25128 Flask-AppBuilder incorrect authentication when using auth type OpenID Critical 9.1
• CVE-2021-41265 Improper Authentication in Flask-AppBuilder High 8.1
• CVE-2023-29005 No Rate Limiting on Login AUTH DB High 7.5
• CVE-2021-32805 URL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilder High 7.2
• CVE-2025-58065 Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2ccw-7px8-vmpf, PYSEC-2026-635.