Skip to content
OpenAdvisories
Medium USN-6792-1 1 CVE

flask-security vulnerability

Published May 28, 2024 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Naom Moshe discovered that Flask-Security incorrectly validated URLs. An attacker could use this issue to redirect users to arbitrary URLs.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS flask-security 1.7.5-2ubuntu0.20.04.1
Ubuntu · 22.04 LTS 22.04:LTS flask-security 4.0.0-1ubuntu0.1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS flask-security 1.7.5-2ubuntu0.18.04.1~esm1

Vulnerabilities 1

  • Medium 5.4
    CVE-2021-23385

    Open Redirect

    This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\e…

    flask-security flask-security flask-security Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2021-23385