{"items":[{"id":"NVI-00008886","kind":"vulnerability","title":"Flask-AppBuilder vulnerable to incorrect authentication when using auth type OpenID ","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-j2pw-vp55-fqqj","CVE-2024-25128"],"plain_summary":"GitHub lists this reviewed advisory for Flask-AppBuilder. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-3d2c430777361e741651c99e748c2196"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-27T16:32:31.000Z","value":"9.1 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-1a6d4164f5025b4491cb5f926033cac0"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.857%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.58433. Missing scores are unknown.","source_id":"sr-3d2c430777361e741651c99e748c2196"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1a6d4164f5025b4491cb5f926033cac0","url":"https://github.com/advisories/GHSA-j2pw-vp55-fqqj","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-j2pw-vp55-fqqj","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:51.534Z"},{"id":"sr-3d2c430777361e741651c99e748c2196","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2024-25128","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:03.704Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1a6d4164f5025b4491cb5f926033cac0"],"technology":"Flask-AppBuilder","known_exclusions":[],"conditions_summary":"### Impact\nWhen Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, allows an attacker to forge an HTTP request, that could deceive the backend into using any requested OpenID service. This vulnerability could grant an attacker unauthorised privilege access if a custom OpenID service is deployed by the attacker and accessible by the backend. \n\nThis vulnerability is only exploitable when the application is using the old (deprecated 10 years ago) OpenID 2.0 authorization protocol (which is very different from the popular OIDC - Open ID Connect - popular protocol used today). Currently, this protocol is regarded as legacy, with significantly reduced usage and not supported for several years by major authorization providers.\n\n### Patches\nUpgrade to Flask-AppBuilder 4.3.11\n\n### Workarounds\nIf upgrade is not possible add the following to your config:\n\n```\nfrom flask import flash, redirect\nfrom flask_appbuilder import expose\nfrom flask_appbuilder.security.sqla.manager import SecurityManager\nfrom flask_appbuilder.security.views import AuthOIDView\nfrom flask_appbuilder.security.forms import LoginForm_oid\n\nbasedir = os.path.abspath(os.path.dirname(__file__))\n\n\nclass FixedOIDView(AuthOIDView):\n   ","public_affected_ranges":["< 4.3.11"]}],"null_published_at":"2026-10-31T22:27:15.300Z","source_updated_at":"2026-10-27T16:32:31.000Z","source_disclosed_at":"2024-02-28T18:37:06.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:56:51.534Z"},{"id":"NVI-00008886","kind":"vulnerability","title":"Flask-AppBuilder vulnerable to incorrect authentication when using auth type OpenID ","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-j2pw-vp55-fqqj","CVE-2024-25128"],"plain_summary":"GitHub lists this reviewed advisory for Flask-AppBuilder. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1a6d4164f5025b4491cb5f926033cac0"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-27T16:32:31.000Z","value":"9.1 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-1a6d4164f5025b4491cb5f926033cac0"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1a6d4164f5025b4491cb5f926033cac0","url":"https://github.com/advisories/GHSA-j2pw-vp55-fqqj","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-j2pw-vp55-fqqj","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:51.534Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1a6d4164f5025b4491cb5f926033cac0"],"technology":"Flask-AppBuilder","known_exclusions":[],"conditions_summary":"### Impact\nWhen Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, allows an attacker to forge an HTTP request, that could deceive the backend into using any requested OpenID service. This vulnerability could grant an attacker unauthorised privilege access if a custom OpenID service is deployed by the attacker and accessible by the backend. \n\nThis vulnerability is only exploitable when the application is using the old (deprecated 10 years ago) OpenID 2.0 authorization protocol (which is very different from the popular OIDC - Open ID Connect - popular protocol used today). Currently, this protocol is regarded as legacy, with significantly reduced usage and not supported for several years by major authorization providers.\n\n### Patches\nUpgrade to Flask-AppBuilder 4.3.11\n\n### Workarounds\nIf upgrade is not possible add the following to your config:\n\n```\nfrom flask import flash, redirect\nfrom flask_appbuilder import expose\nfrom flask_appbuilder.security.sqla.manager import SecurityManager\nfrom flask_appbuilder.security.views import AuthOIDView\nfrom flask_appbuilder.security.forms import LoginForm_oid\n\nbasedir = os.path.abspath(os.path.dirname(__file__))\n\n\nclass FixedOIDView(AuthOIDView):\n   ","public_affected_ranges":["< 4.3.11"]}],"null_published_at":"2026-10-31T22:13:27.121Z","source_updated_at":"2026-10-27T16:32:31.000Z","source_disclosed_at":"2024-02-28T18:37:06.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:56:51.534Z"}],"next_cursor":null,"snapshot_revision":"42594"}