Impact Flask-AppBuilder prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Patches Flask-AppBuilder 4.6.2 introduced the FABSAFEREDIRECTHOSTS configuration variable, which allows administrators to explicitly define which domains are considered safe for redirection.

Examples: FABSAFEREDIRECTHOSTS = ["yourdomain.com", "sub.yourdomain.com", ".yourcompany.com"]

Workarounds Use a Reverse Proxy to Enforce Trusted Host Headers

References Are there any links users can visit to find out more?