CVE-2023-29005 No Rate Limiting on Login AUTH DB
Attackers can brute-force user credentials due to missing rate limiting, requiring configuration changes to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-29005?
CVE-2023-29005 is a high-severity vulnerability in dpgaspar Flask-AppBuilder, published on 10 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using `AUTH_RATE_LIMITED = True`, `RATELIMIT_ENABLED = True`, and setting an `AUTH_RATE_LIMIT`.
Weakness: CWE-307
Which versions are affected by CVE-2023-29005?
3 open source packages ship an affected version, including flask-appbuilder and Flask-AppBuilder. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
flask-appbuilder PyPI | All versions | 4.3.0 |
flask-appbuilder PyPI | All versions | 4.3.0 |
Flask-AppBuilder PyPI | All versions | 4.3.0 |
Products include Dpgaspar Flask-Appbuilder.
How do I fix CVE-2023-29005?
Upgrade flask-appbuilder to 4.3.0 or later.
Is CVE-2023-29005 being exploited?
There is no known exploitation of CVE-2023-29005 in the wild and no public exploit code.
Other vulnerabilities in dpgaspar Flask-AppBuilder
- CVE-2024-25128 Flask-AppBuilder incorrect authentication when using auth type OpenID
- CVE-2021-41265 Improper Authentication in Flask-AppBuilder
- CVE-2021-32805 URL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilder
- CVE-2025-58065 Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods
- CVE-2022-24776 Open Redirect in Flask-AppBuilder
Sources
Also known as GHSA-9hcr-9hcv-x6pv, PYSEC-2026-1380.