CVE-2025-24023 Overview
CVE-2025-24023 is a username enumeration vulnerability in Flask-AppBuilder, an application development framework built on Flask. Versions prior to 4.5.3 allow unauthenticated attackers to determine whether a username exists by measuring response times during login requests. The server processes valid and invalid usernames with observably different timing, exposing a side channel [CWE-208, CWE-203, CWE-204]. Attackers can brute force login endpoints and correlate response latency to build a list of valid accounts. This intelligence enables downstream credential stuffing, password spraying, and targeted phishing. The maintainers fixed the issue in version 4.5.3.
Critical Impact
Unauthenticated remote attackers can enumerate valid usernames through response-time analysis, enabling follow-on credential attacks against Flask-AppBuilder deployments.
Affected Products
- Flask-AppBuilder versions prior to 4.5.3
- Applications built on dpgaspar/flask-appbuilder using the default authentication views
- Downstream projects bundling vulnerable Flask-AppBuilder releases
Discovery Timeline
- 2025-03-03 - CVE-2025-24023 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24023
Vulnerability Analysis
The vulnerability is a timing side channel in the Flask-AppBuilder authentication flow. When a login request arrives, the framework performs different operations depending on whether the submitted username exists in the user store. For a known username, the backend retrieves the stored password hash and executes a cryptographic verification routine. For an unknown username, the verification step is skipped or short-circuited, returning a failure response noticeably faster.
An attacker can submit login attempts with candidate usernames and record round-trip latency. Statistically higher response times indicate that the username exists and triggered the hashing routine. Because the endpoint requires no authentication, this reconnaissance is available to any network-adjacent attacker who can reach the login page.
Root Cause
The root cause is the absence of a constant-time authentication path. The login handler does not perform an equivalent dummy hash computation when a username is not found, so the branch executed for valid users takes measurably longer than the branch for invalid users. This falls under observable discrepancy weaknesses [CWE-203] and response discrepancy information exposure [CWE-204].
Attack Vector
Exploitation requires only network access to the login endpoint. An attacker scripts repeated POST requests to the authentication URL with candidate usernames and arbitrary passwords, measures server response time, and classifies usernames based on latency thresholds. No credentials, user interaction, or elevated privileges are required. Successful enumeration produces a list of valid accounts for use in credential stuffing, password spraying, or targeted social engineering campaigns.
See the Flask-AppBuilder GitHub Security Advisory for maintainer details.
Detection Methods for CVE-2025-24023
Indicators of Compromise
- High-volume POST requests to /login/ or /api/v1/security/login from a single source IP within short time windows
- Sequential login attempts iterating through common usernames or email addresses with identical or randomized passwords
- User-Agent strings consistent with automation tools such as python-requests, curl, or custom scripts
- Requests exhibiting timing analysis patterns, such as repeated attempts against the same username to average latency
Detection Strategies
- Alert on authentication endpoints receiving more than a defined threshold of failed logins per source IP per minute
- Correlate failed login attempts across many distinct usernames from the same source, which indicates enumeration rather than credential guessing
- Monitor web server access logs for repeated 401 or 200 responses on /login/ with varying username parameters
- Baseline normal login request rates per client and flag deviations exceeding standard thresholds
Monitoring Recommendations
- Ingest web application and reverse proxy logs into a centralized analytics platform for query and correlation
- Track authentication failure counts per username and per source IP to identify enumeration attempts
- Deploy a Web Application Firewall (WAF) rule to rate-limit unauthenticated POSTs to login endpoints
- Review dependency manifests such as requirements.txt and poetry.lock to identify Flask-AppBuilder versions below 4.5.3
How to Mitigate CVE-2025-24023
Immediate Actions Required
- Upgrade Flask-AppBuilder to version 4.5.3 or later across all environments
- Inventory applications depending on flask-appbuilder and prioritize internet-exposed instances
- Enable rate limiting on the login endpoint to slow enumeration attempts
- Enforce account lockout or CAPTCHA challenges after repeated failed logins from a source
Patch Information
The maintainers fixed CVE-2025-24023 in Flask-AppBuilder 4.5.3. Upgrade using pip install --upgrade flask-appbuilder>=4.5.3 and redeploy. Review the GitHub Security Advisory GHSA-p8q5-cvwx-wvwp for release notes and version constraints.
Workarounds
- Place the authentication endpoint behind a reverse proxy that enforces aggressive rate limiting per source IP
- Deploy a WAF rule blocking sources that exceed acceptable failed-login thresholds against /login/
- Add randomized response delays or a dummy hash computation on the invalid-username path if maintaining a custom fork
- Require multi-factor authentication (MFA) so enumerated usernames alone cannot be leveraged for account takeover
# Configuration example: upgrade Flask-AppBuilder to the patched release
pip install --upgrade 'flask-appbuilder>=4.5.3'
# Verify installed version
python -c "import flask_appbuilder; print(flask_appbuilder.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
