CVE-2025-32962
published 2025-05-16CVE-2025-32962: Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to…
PriorityP429medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.19%
9.0th percentile
Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the `FAB_SAFE_REDIRECT_HOSTS` configuration variable, which allows administrators to explicitly define which domains are considered safe for redirection. As a workaround, use a reverse proxy to enforce trusted host headers.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dpgaspar | flask-appbuilder | < 4.6.2 | 4.6.2 |
| dpgaspar | flask-appbuilder | >= 0 < 4.6.2 | 4.6.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Flask-AppBuilder open redirect vulnerability using HTTP host injection
osv·2025-05-16
CVE-2025-32962 [MEDIUM] Flask-AppBuilder open redirect vulnerability using HTTP host injection
Flask-AppBuilder open redirect vulnerability using HTTP host injection
### Impact
Flask-AppBuilder prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests.
### Patches
Flask-AppBuilder 4.6.2 introduced the `FAB_SAFE_REDIRECT_HOSTS` configuration variable, which allows administrators to explicitly define which domains are considered safe for redirection.
Examples:
```
FAB_SAFE_REDIRECT_HOSTS = ["yourdomain.com", "sub.yourdomain.com", "*.yourcompany.com"]
```
### Workarounds
Use a Reverse Proxy to Enforce Trusted Host Headers
### References
_Are there any links users can visit to find out more?_
GHSA
Flask-AppBuilder open redirect vulnerability using HTTP host injection
ghsa·2025-05-16
CVE-2025-32962 [MEDIUM] CWE-601 Flask-AppBuilder open redirect vulnerability using HTTP host injection
Flask-AppBuilder open redirect vulnerability using HTTP host injection
### Impact
Flask-AppBuilder prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests.
### Patches
Flask-AppBuilder 4.6.2 introduced the `FAB_SAFE_REDIRECT_HOSTS` configuration variable, which allows administrators to explicitly define which domains are considered safe for redirection.
Examples:
```
FAB_SAFE_REDIRECT_HOSTS = ["yourdomain.com", "sub.yourdomain.com", "*.yourcompany.com"]
```
### Workarounds
Use a Reverse Proxy to Enforce Trusted Host Headers
### References
_Are there any links users can visit to find out more?_
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-05-16
Published