CVE-2025-32962 Flask-AppBuilder open redirect vulnerability using HTTP host injection

What is CVE-2025-32962?

CVE-2025-32962 is a medium-severity vulnerability in dpgaspar Flask-AppBuilder, published on 16 May 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the `FAB_SAFE_REDIRECT_HOSTS` configuration variable, which allows administrators to explicitly define which domains are considered safe for redirection. As a workaround, use a reverse proxy to enforce trusted host headers.

Weakness: CWE-601

Which versions are affected by CVE-2025-32962?

3 open source packages ship an affected version, including flask-appbuilder. It affects 1 product.

Products include Dpgaspar Flask-Appbuilder.

How do I fix CVE-2025-32962?

Upgrade flask-appbuilder to 4.6.2 or later.

Is CVE-2025-32962 being exploited?

There is no known exploitation of CVE-2025-32962 in the wild and no public exploit code.

Other vulnerabilities in dpgaspar Flask-AppBuilder

• CVE-2024-25128 Flask-AppBuilder incorrect authentication when using auth type OpenID Critical 9.1
• CVE-2021-41265 Improper Authentication in Flask-AppBuilder High 8.1
• CVE-2023-29005 No Rate Limiting on Login AUTH DB High 7.5
• CVE-2021-32805 URL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilder High 7.2
• CVE-2025-58065 Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-XC11727, ECHO-dcfd-9155-eb11, GHSA-99pm-ch96-ccp2, MINI-xgx2-7p69-f84f, PYSEC-2026-1379, ROOT-APP-PYPI-CVE-2025-32962.