Executive brief
Flask-AppBuilder vulnerable to incorrect authentication when using auth type OpenID
Affected products
- PyPI flask-appbuilder
Junglewise Threat Intelligence
CVE-2024-25128: PYSEC-2026-340 - Flask-AppBuilder vulnerable to incorrect authentication when using auth type OpenID
CVE-2024-25128 · Severity: low · CVSS 3.1 · Published 2026-06-29
Technologies: flask-appbuilder (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1378 - Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods
- PYSEC-2026-1379 - Flask-AppBuilder open redirect vulnerability using HTTP host injection
- PYSEC-2026-1382 - Flask-AppBuilder's login form allows browser to cache sensitive fields
- PYSEC-2026-1381 - Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)
- PYSEC-2026-1380 - Flask-AppBuilder Has No Rate Limiting on Login AUTH DB