CVE-2025-58065

Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. This allows an enabled user to reset their password and be able to create JWT tokens even after the user is disabled on the authentication provider. Users should upgrade to Flask-AppBuilder version 4.8.1 or later to receive a fix. If immediate upgrade is not possible, manually disable password reset routes in the application configuration; implement additional access controls at the web server or proxy level to block access to the reset my password URL; and/or monitor for suspicious password reset attempts from disabled accounts.

• CWE-287

• https://github.com/dpgaspar/Flask-AppBuilder/commit/a942a9cc5775752f9a02f97fd8198dd288fa93eePatch
• https://github.com/dpgaspar/Flask-AppBuilder/pull/2384Issue Tracking, Patch
• https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v4.8.1Release Notes
• https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-765j-9r45-w2q2Vendor Advisory

Published

Sep 11, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-5806Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling r…8
• CVE-2025-58060OpenPrinting CUPS is an open source printing system for Linu…8
• CVE-2025-58061OpenEBS Local PV RawFile allows dynamic deployment of Statef…5.5
• CVE-2025-58062LSTM-Kirigaya's openmcp-client is a vscode plugin for mcp de…7.3
• CVE-2025-58063CoreDNS is a DNS server that chains plugins. Starting in ver…7.1
• CVE-2025-58064CKEditor 5 is a modern JavaScript rich-text editor with an M…2.3
• CVE-2025-58066nptd-rs is a tool for synchronizing your computer's clock, i…5.3
• CVE-2025-58067Basecamp's Google Sign-In adds Google sign-in to Rails appli…4.2
• CVE-2025-58068Eventlet is a concurrent networking library for Python. Prio…9.1
• CVE-2025-58069The use of a hard-coded cryptographic key was discovered in …6.9
• CVE-2025-5807The Gwolle Guestbook plugin for WordPress is vulnerable to S…6.1
• CVE-2025-58070Pleasanter contains a stored cross-site scripting vulnerabil…6.1