CVE-2025-32962: Flask-AppBuilder open redirect vulnerability using HTTP host injection
Impact Flask-AppBuilder prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Patches Flask-AppBuilder 4.6.2 introduced the FABSAFEREDIRECTHOSTS configuration variable, which allows administrators to explicitly define which domains are considered safe for redirection.
Examples: FABSAFEREDIRECTHOSTS = ["yourdomain.com", "sub.yourdomain.com", ".yourcompany.com"]
Workarounds Use a Reverse Proxy to Enforce Trusted Host Headers
References Are there any links users can visit to find out more?
Other sources
Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the FABSAFEREDIRECTHOSTS configuration variable, which allows administrators to explicitly define which domains are considered safe for redirection. As a workaround, use a reverse proxy to enforce trusted host headers.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32962?
CVE-2025-32962 is considered a high severity vulnerability due to the potential for open redirects caused by host header manipulation.
How do I fix CVE-2025-32962?
To fix CVE-2025-32962, upgrade Flask-AppBuilder to version 4.6.2 or later, which addresses the vulnerability.
Who is affected by CVE-2025-32962?
CVE-2025-32962 affects all versions of Flask-AppBuilder prior to 4.6.2.
What type of vulnerability is CVE-2025-32962?
CVE-2025-32962 is an open redirect vulnerability that can be exploited by unauthenticated actors.
When was CVE-2025-32962 disclosed?
CVE-2025-32962 was disclosed in the advisory for Flask-AppBuilder security issues.