# CVE-2022-24776: PYSEC-2026-635 - Open Redirect in Flask-AppBuilder

Source: https://junglewise.ai/threats/cve-2022-24776-flask-appbuilder-open-redirect-in-database-authentication-login  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2022-24776 · Severity: low · CVSS 3.1 · Published 2026-07-02

Flask-AppBuilder is a Python framework for rapidly building web applications on top of Flask. The database authentication login page contains an open redirect vulnerability that allows an attacker to redirect users to arbitrary external websites. An attacker could craft a malicious link to trick users into visiting phishing pages or other untrusted sites, compromising user credentials or spreading malware.

Technologies: [flask-appbuilder (PyPI)](https://junglewise.ai/threats/technologies/flask-appbuilder). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2022-24776 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-24776 being exploited in the wild.

**How severe is CVE-2022-24776?** Low severity, with a CVSS score of 3.1, published 2 July 2026.

**Which products and versions are affected?** flask-appbuilder (PyPI) ECOSYSTEM:introduced=0,fixed=3.4.5.

**Is there a fix for CVE-2022-24776?** Yes. flask-appbuilder (PyPI): upgrade to 3.4.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-24776 attacked?** It is attacked over the network.

**Am I affected by CVE-2022-24776?** Check whether you run flask-appbuilder (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- flask-appbuilder (PyPI): upgrade to 3.4.5 or later

  ```sh
  pip install "flask-appbuilder>=3.4.5"
  ```


## Technical details

Flask-AppBuilder versions prior to 3.4.5 contain a CWE-601 open redirect vulnerability in the database authentication login page. The application accepts user-controlled input that specifies a redirect URL and uses it without proper validation or sanitization. The vulnerability is exploitable via the network with no authentication required, but user interaction is necessary (user must click a crafted link). An attacker can redirect authenticated users to an untrusted external site. The fix is available in version 3.4.5 and later.

## Affected products

- Flask-AppBuilder Flask-AppBuilder before 3.4.5

## Identifiers

- CVE-2022-24776
- GHSA-2ccw-7px8-vmpf
- PYSEC-2026-635

## Timeline

- 2022-03-24: disclosed: Security advisory published
- 2022-03-25: patched: Version 3.4.5 released with fix

## References

- [https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-2ccw-7px8-vmpf](https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-2ccw-7px8-vmpf)

## Related threats

- [PYSEC-2026-1378 - Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods](https://junglewise.ai/threats/cve-2025-58065-flask-app-builder-has-an-authentication-bypass-vulnerability-when)
- [PYSEC-2026-1379 - Flask-AppBuilder open redirect vulnerability using HTTP host injection](https://junglewise.ai/threats/cve-2025-32962-flask-appbuilder-open-redirect-vulnerability-using-http-host)
- [PYSEC-2026-1382 - Flask-AppBuilder's login form allows browser to cache sensitive fields](https://junglewise.ai/threats/cve-2024-45314-flask-appbuilder-s-login-form-allows-browser-to-cache-sensitive)
- [PYSEC-2026-1381 - Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)](https://junglewise.ai/threats/cve-2024-27083-flask-appbuilder-s-oauth-login-page-subject-to-cross-site)
- [PYSEC-2026-1380 - Flask-AppBuilder Has No Rate Limiting on Login AUTH DB](https://junglewise.ai/threats/cve-2023-29005-flask-appbuilder-has-no-rate-limiting-on-login-auth-db)