CVE-2022-24776: Open Redirect in Flask-AppBuilder

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-24 · updated 2026-06-17
Weakness: CWE-601

Description

Flask-AppBuilder is an application development framework, built on top of the Flask web framework. Flask-AppBuilder contains an open redirect vulnerability when using database authentication login page on versions below 3.4.5. This issue is fixed in version 3.4.5. There are currently no known workarounds.

Affected products

dpgaspar Flask-AppBuilder: before 3.4.5 — fixed in 3.4.5

How to fix

Upgrade to a fixed version: dpgaspar Flask-AppBuilder 3.4.5. Check the vendor advisory for mitigations.

References

https://github.com/dpgaspar/Flask-AppBuilder/pull/1804
https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.4.5
https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-2ccw-7px8-vmpf
https://github.com/dpgaspar/Flask-AppBuilder/pull/1804
https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.4.5
https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-2ccw-7px8-vmpf

Get alerted when CVE-2022-24776 or the next vulnerability affects your stack