PyPI: flask-appbuilder
CVE-2025-58065
Safety vulnerability ID: SFTY-20250911-95961
Safety legacy ID: pyup.io-79598
Affected versions of the flask-appbuilder package are vulnerable to Improper Authentication due to the password-reset endpoint remaining registered and reachable when non-AUTH_DB authentication (e.g., OAuth or LDAP) is enabled. The framework continued to expose password-reset routes (such as ResetMyPasswordView) even though the link was hidden in the UI, allowing local password/JWT flows to proceed without checking the external identity provider’s disabled state. An attacker with an enabled account in Flask-AppBuilder can directly invoke the reset-my-password URL while the deployment uses OAuth/LDAP and set a new password to mint JWT tokens, effectively retaining access even if they were disabled on the external provider.
Overview
Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods
Advisory
Affected versions of the flask-appbuilder package are vulnerable to Improper Authentication due to the password-reset endpoint remaining registered and reachable when non-AUTH_DB authentication (e.g., OAuth or LDAP) is enabled. The framework continued to expose password-reset routes (such as ResetMyPasswordView) even though the link was hidden in the UI, allowing local password/JWT flows to proceed without checking the external identity provider’s disabled state. An attacker with an enabled account in Flask-AppBuilder can directly invoke the reset-my-password URL while the deployment uses OAuth/LDAP and set a new password to mint JWT tokens, effectively retaining access even if they were disabled on the external provider.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20250911-95961/CVE-2025-58065
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58065
- https://github.com/advisories/GHSA-765j-9r45-w2q2
- https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-765j-9r45-w2q2
- https://github.com/dpgaspar/Flask-AppBuilder/pull/2384
- https://github.com/dpgaspar/Flask-AppBuilder/commit/a942a9cc5775752f9a02f97fd8198dd288fa93ee
- https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v4.8.1
- https://nvd.nist.gov/vuln/detail/CVE-2025-58065
- https://github.com/advisories/GHSA-765j-9r45-w2q2
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more