CVE-2025-24023 — Observable Response Discrepancy in flask-appbuilder

CVE-2025-24023

Observable Response Discrepancy in flask-appbuilder PUBLISHED

Description (CNA)

Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3.

Affected (CNA)

Vendor / product	Versions
dpgaspar / Flask-AppBuilder	affected < 4.5.3

CWE

CWE-204

References

https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-p8q5-cvwx-wvwp

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.