Executive brief
Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)
Affected products
- PyPI flask-appbuilder
Junglewise Threat Intelligence
CVE-2024-27083: PYSEC-2026-1381 - Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)
CVE-2024-27083 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: flask-appbuilder (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1378 - Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods
- PYSEC-2026-1379 - Flask-AppBuilder open redirect vulnerability using HTTP host injection
- PYSEC-2026-1382 - Flask-AppBuilder's login form allows browser to cache sensitive fields
- PYSEC-2026-1380 - Flask-AppBuilder Has No Rate Limiting on Login AUTH DB
- PYSEC-2026-635 - Open Redirect in Flask-AppBuilder