CVE-2024-25128 Flask-AppBuilder incorrect authentication when using auth type OpenID

What is CVE-2024-25128?

CVE-2024-25128 is a critical vulnerability in dpgaspar Flask-AppBuilder, published on 28 Feb 2024.

Official description

Flask-AppBuilder is an application development framework, built on top of Flask. When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, it allows an attacker to forge an HTTP request, that could deceive the backend into using any requested OpenID service. This vulnerability could grant an attacker unauthorised privilege access if a custom OpenID service is deployed by the attacker and accessible by the backend. This vulnerability is only exploitable when the application is using the OpenID 2.0 authorization protocol. Upgrade to Flask-AppBuilder 4.3.11 to fix the vulnerability.

Weakness: CWE-287

Which versions are affected by CVE-2024-25128?

3 open source packages ship an affected version, including flask-appbuilder and Flask-AppBuilder. It affects 1 product.

Products include Dpgaspar Flask-Appbuilder.

How do I fix CVE-2024-25128?

Upgrade flask-appbuilder to 4.3.11 or later.

Is CVE-2024-25128 being exploited?

There is no known exploitation of CVE-2024-25128 in the wild and no public exploit code.

Other vulnerabilities in dpgaspar Flask-AppBuilder

• CVE-2021-41265 Improper Authentication in Flask-AppBuilder High 8.1
• CVE-2023-29005 No Rate Limiting on Login AUTH DB High 7.5
• CVE-2021-32805 URL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilder High 7.2
• CVE-2025-58065 Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods Medium 6.5
• CVE-2022-24776 Open Redirect in Flask-AppBuilder Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ECHO-52c1-f769-b858, GHSA-j2pw-vp55-fqqj, PYSEC-2026-340, ROOT-APP-PYPI-CVE-2024-25128.