Skip to content
OpenAdvisories

Package · PyPI

flask-security

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.7
    GHSA-w2j7-f3c6-g8cw

    Flask-Security has an Open Redirect issue

    # Open Redirect in Flask-Security ## Summary `flask_security.utils.validate_redirect_url()` can allow an attacker-controlled redirect URL when subdomain redirects are enabled. The bypass uses a backslash inside the URL authority/host: ```text http://evil.com\…

    flask-security PyPI
  • Medium 5.4
    CVE-2021-23385

    Open Redirect

    This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\e…

    flask-security flask-security flask-security Debian Ubuntu PyPI