low3.7
CVE-2025-24023
Flask-AppBuilder Observable Response Discrepancy
Impact
### Impact User enumeration in database authentication in Flask-AppBuilder <= 4.5.3 and werkzeug >= 3.0.0. Allows for a non authenticated user to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. ### Patches Upgrade to flask-appbuilder>=4.5.3 ### Workarounds Downgrade werkzeug to <3.0.0 ### References _Are there any links users can visit to find out more?_
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | flask-appbuilder | < 4.5.3 | 4.5.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dpgaspar | Flask-Appbuilder | before 4.5.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-p8q5-cvwx-wvwp
- https://github.com/advisories/GHSA-p8q5-cvwx-wvwp
- https://nvd.nist.gov/vuln/detail/CVE-2025-24023
- https://github.com/pypa/advisory-database/tree/main/vulns/flask-appbuilder/PYSEC-2025-15.yaml