CVE-2025-58065: Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods
Impact When Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. This allows an enabled user to reset their password and be able to create JWT tokens even after the user is disabled on the authentication provider.
Patches Upgrade to Flask-AppBuilder version 4.8.1 or later
Workarounds If immediate upgrade is not possible: - Manually disable password reset routes in the application configuration - Implement additional access controls at the web server or proxy level to block access to the reset my password URL. - Monitor for suspicious password reset attempts from disabled accounts
Other sources
Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. This allows an enabled user to reset their password and be able to create JWT tokens even after the user is disabled on the authentication provider. Users should upgrade to Flask-AppBuilder version 4.8.1 or later to receive a fix. If immediate upgrade is not possible, manually disable password reset routes in the application configuration; implement additional access controls at the web server or proxy level to block access to the reset my password URL; and/or monitor for suspicious password reset attempts from disabled accounts.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58065?
CVE-2025-58065 has a medium severity rating due to the risk of unauthorized password resets.
How do I fix CVE-2025-58065?
To address CVE-2025-58065, upgrade flask-appbuilder to version 4.8.1 or higher.
What causes CVE-2025-58065?
CVE-2025-58065 is caused by the password reset endpoint being accessible without proper display in the user interface when non-database authentication methods are used.
Who is affected by CVE-2025-58065?
Users of flask-appbuilder configured with OAuth, LDAP, or similar non-database authentication methods are affected by CVE-2025-58065.
What should I do if I can't upgrade to fix CVE-2025-58065?
If an upgrade is not feasible, consider implementing additional security measures to restrict access to the password reset functionality.