OAuth and LDAP Authentication Flaw in Flask-AppBuilder
CVE-2025-58065

6.5MEDIUM

Key Information:

Vendor

Dpgaspar

Status
Flask-appbuilder
Vendor
CVE Published:
11 September 2025

What is CVE-2025-58065?

The vulnerability in Flask-AppBuilder occurs when it is set up to use OAuth, LDAP, or other non-database authentication methods. In versions before 4.8.1, the password reset endpoint is inadvertently kept active, allowing users to reset their passwords even after being disabled by the authentication provider. This flaw could potentially let unauthorized users generate JWT tokens, posing significant risks to application security. Upgrading to version 4.8.1 or later is essential. If an upgrade is not feasible immediately, it is recommended to manually disable the password reset routes in the application settings and implement additional access restrictions at the web server or proxy level to prevent unauthorized access. Regular monitoring of password reset attempts from disabled accounts is also advised.

Affected Version(s)

Flask-AppBuilder < 4.8.1

References

https://github.com/dpgaspar/Flask-AppBuilder/security/adv...
x_refsource_CONFIRM
https://github.com/dpgaspar/Flask-AppBuilder/pull/2384
x_refsource_MISC
https://github.com/dpgaspar/Flask-AppBuilder/commit/a942a...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-58065 : OAuth and LDAP Authentication Flaw in Flask-AppBuilder