Changes.Watch~ upgrade verdicts ~
Free digest
ExploitedPHP2Shell is now on CISA KEV

critical vulnerability

Flask-AppBuilder vulnerable to incorrect authentication when using auth type OpenID

Fix availableCritical · CVSS 9.1EPSS 0.86%

Published Feb 28, 2024 · updated Oct 27, 2026

What to do

  1. Upgrade to a fixed version: Flask-AppBuilder 4.3.11.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIFlask-AppBuilder1,057,942 downloads/week

Vulnerable versions
< 4.3.11
Fixed in
4.3.11

Check your project: pip show Flask-AppBuilder

Sources

CWE-287 Improper Authentication

← All critical vulnerabilities