CVE-2021-23401

This affects all versions of package Flask-User. When using the make_safe_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as /////evil.com/path or \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.

• CWE-601

• https://github.com/lingthio/Flask-UserProduct, Third Party Advisory
• https://github.com/lingthio/Flask-User/blob/master/flask_user/user_manager__utils.pyExploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-PYTHON-FLASKUSER-1293188Third Party Advisory
• https://github.com/lingthio/Flask-UserProduct, Third Party Advisory
• https://github.com/lingthio/Flask-User/blob/master/flask_user/user_manager__utils.pyExploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-PYTHON-FLASKUSER-1293188Third Party Advisory

Published

Jul 5, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23396All versions of package lutils are vulnerable to Prototype P…9.8
• CVE-2021-23397All versions of package @ianwalter/merge are vulnerable to P…9.8
• CVE-2021-23398All versions of package react-bootstrap-table are vulnerable…6.1
• CVE-2021-23399This affects all versions of package wincred. If attacker-co…9.8
• CVE-2021-2340Vulnerability in the MySQL Server product of Oracle MySQL (c…2.7
• CVE-2021-23400The package nodemailer before 6.6.1 are vulnerable to HTTP H…8.8
• CVE-2021-23402All versions of package record-like-deep-assign are vulnerab…9.8
• CVE-2021-23403All versions of package ts-nodash are vulnerable to Prototyp…9.8
• CVE-2021-23404This affects all versions of package sqlite-web. The SQL das…8.8
• CVE-2021-23405This affects the package pimcore/pimcore before 10.0.7. This…8.8
• CVE-2021-23406This affects the package pac-resolver before 5.0.0. This can…9.8
• CVE-2021-23407This affects the package elFinder.Net.Core from 0 and before…7.5