CVE-2025-32962: Flask-AppBuilder open redirect vulnerability using HTTP host injection

May 16, 2025

Flask-AppBuilder prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests.

References

github.com/advisories/GHSA-99pm-ch96-ccp2
github.com/dpgaspar/Flask-AppBuilder
github.com/dpgaspar/Flask-AppBuilder/commit/32eedbbb5cb483a3e782c5f2732de4a6a650d9b6
github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-99pm-ch96-ccp2
nvd.nist.gov/vuln/detail/CVE-2025-32962

Code Behaviors & Features

Detect and mitigate CVE-2025-32962 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →