CVE-2025-32962: Flask-AppBuilder open redirect vulnerability using HTTP host injection

May 16, 2025

Flask-AppBuilder prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests.

References

github.com/advisories/GHSA-99pm-ch96-ccp2
github.com/dpgaspar/Flask-AppBuilder
github.com/dpgaspar/Flask-AppBuilder/commit/32eedbbb5cb483a3e782c5f2732de4a6a650d9b6
github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-99pm-ch96-ccp2
nvd.nist.gov/vuln/detail/CVE-2025-32962

Code Behaviors & Features

Detect and mitigate CVE-2025-32962 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →