CVE-2025-32962: Dpgaspar Flask-Appbuilder

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the `FAB_SAFE_REDIRECT_HOSTS` configuration variable, which allows administrators to explicitly define which domains are considered safe for redirection. As a workaround, use a reverse proxy to enforce trusted host headers.

Affected products

• Dpgaspar Flask-Appbuilder: before 4.6.2 (fixed in 4.6.2)

Published 2025-05-16. Last modified 2026-06-17.