CVE-2025-32962: Flask-AppBuilder Open Redirect Vulnerability

CVE-2025-32962 Overview

CVE-2025-32962 is an open redirect vulnerability in Flask-AppBuilder, an application development framework built on top of Flask. Versions prior to 4.6.2 allow an unauthenticated attacker to perform an open redirect by manipulating the Host header in HTTP requests. The redirect validation logic trusted the request host without cross-checking it against an allowlist of safe domains.

The issue is tracked under CWE-601: URL Redirection to Untrusted Site. Flask-AppBuilder 4.6.2 introduced the FAB_SAFE_REDIRECT_HOSTS configuration variable, allowing administrators to explicitly define which domains are considered safe for redirection.

Critical Impact
Attackers can craft phishing links pointing to a trusted Flask-AppBuilder application that silently redirect victims to attacker-controlled domains after user interaction.

Affected Products

Flask-AppBuilder versions prior to 4.6.2
Applications using dpgaspar:flask-appbuilder as a dependency
Downstream projects embedding Flask-AppBuilder authentication flows

Discovery Timeline

2025-05-16 - CVE-2025-32962 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32962

Vulnerability Analysis

Flask-AppBuilder's redirect helper validates target URLs against a list of "safe hosts" before performing a redirect. In versions prior to 4.6.2, when no allowlist was configured the code fell back to trusting the value derived from request.host_url. Because the Host header is attacker-controllable when the application is exposed directly or behind a misconfigured proxy, an attacker can spoof the header to make an arbitrary domain appear as a safe redirect target.

The patch renames the configuration key from SAFE_REDIRECT_HOSTS to FAB_SAFE_REDIRECT_HOSTS and documents the option so administrators can define trusted domains explicitly. The vulnerability requires user interaction because the victim must click the crafted link, which limits impact but makes it well-suited for phishing campaigns leveraging a trusted domain.

Root Cause

The root cause is improper validation of redirect targets [CWE-601]. The safe-host derivation relied on the untrusted Host header via request.host_url when no allowlist was configured, defeating the purpose of the safe-redirect check.

Attack Vector

An attacker crafts a URL to a legitimate Flask-AppBuilder endpoint that accepts a next or similar redirect parameter, then sets the Host header (or manipulates request routing) so the application resolves the attacker's domain as a valid host. The victim, seeing a trusted domain in the initial link, clicks and is redirected to the attacker's site for credential harvesting or malware delivery.

python

# Security patch in flask_appbuilder/utils/base.py
# Source: https://github.com/dpgaspar/Flask-AppBuilder/commit/32eedbbb5cb483a3e782c5f2732de4a6a650d9b6
    scheme = "http"
valid_schemes = ["http", "https"]

-    safe_hosts = current_app.config.get("SAFE_REDIRECT_HOSTS", [])
+    safe_hosts = current_app.config.get("FAB_SAFE_REDIRECT_HOSTS", [])
if not safe_hosts:
    safe_hosts = [urlparse(request.host_url).netloc]

The patch renames the configuration key so administrators must explicitly opt in to a curated allowlist. See the GitHub Security Advisory GHSA-99pm-ch96-ccp2 for full details.

Detection Methods for CVE-2025-32962

Indicators of Compromise

HTTP requests to Flask-AppBuilder endpoints containing Host header values that do not match the deployed FQDN.
Redirect responses (HTTP 302/303) with Location headers pointing to external domains not owned by the organization.
Elevated volume of requests to login or logout endpoints that include a next parameter referencing external URLs.

Detection Strategies

Inspect web server and reverse proxy logs for mismatches between the received Host header and the expected virtual host.
Search application logs for 302 responses where the redirect target's registrable domain differs from the application's own domain.
Correlate phishing reports that reference URLs on the Flask-AppBuilder application's domain with subsequent outbound redirect events.

Monitoring Recommendations

Enable structured access logging that captures both the raw Host header and the resolved Location header on redirect responses.
Alert on any Host header value outside a known allowlist of production hostnames.
Track version metadata of flask-appbuilder across deployments to identify hosts still running versions below 4.6.2.

How to Mitigate CVE-2025-32962

Immediate Actions Required

Upgrade Flask-AppBuilder to version 4.6.2 or later across all environments.
Configure FAB_SAFE_REDIRECT_HOSTS with an explicit list of trusted domains once upgraded.
Audit application code for any additional redirect helpers that consume user-supplied URLs without validation.

Patch Information

The fix is delivered in Flask-AppBuilder 4.6.2 via commit 32eedbb. The patch renames the configuration variable to FAB_SAFE_REDIRECT_HOSTS and requires administrators to define allowed redirect domains. Full details are available in the GitHub Security Advisory GHSA-99pm-ch96-ccp2.

Workarounds

Place Flask-AppBuilder behind a reverse proxy configured to enforce and rewrite the Host header to a trusted value before forwarding requests.
Reject requests at the proxy layer when the Host header does not match the expected FQDN.
Strip or validate next and similar redirect parameters at the edge to block external URLs until the upgrade is applied.

bash

# Example: enforce trusted Host header in nginx reverse proxy
server {
    listen 443 ssl;
    server_name app.example.com;

    if ($host != "app.example.com") {
        return 400;
    }

    location / {
        proxy_set_header Host app.example.com;
        proxy_pass http://flask_appbuilder_upstream;
    }
}

# Flask-AppBuilder config.py after upgrading to >=4.6.2
FAB_SAFE_REDIRECT_HOSTS = ["app.example.com", "auth.example.com"]