CVE-2025-58065
📋 TL;DR
Flask-AppBuilder versions before 4.8.1 have a vulnerability where the password reset endpoint remains accessible when using OAuth, LDAP, or other non-database authentication methods. This allows disabled users to reset their password and generate JWT tokens, bypassing account deactivation. Organizations using Flask-AppBuilder with non-database authentication are affected.
💻 Affected Systems
- Flask-AppBuilder
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Disabled malicious users regain access to the application, potentially compromising sensitive data or performing unauthorized actions with valid JWT tokens.
Likely Case
Former employees or deactivated users regain access to applications they should no longer have access to, leading to data exposure or policy violations.
If Mitigated
With proper controls, disabled users cannot authenticate or access resources even if they reset passwords.
🎯 Exploit Status
Requires a disabled user account with knowledge of the password reset endpoint. No authentication bypass for new users.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.8.1
Vendor Advisory: https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-765j-9r45-w2q2
Restart Required: No
Instructions:
1. Upgrade Flask-AppBuilder to version 4.8.1 or later using pip: 'pip install Flask-AppBuilder>=4.8.1'. 2. Verify the upgrade with 'pip show Flask-AppBuilder'. 3. No application restart required for the framework update.
🔧 Temporary Workarounds
Disable password reset routes manually
allManually disable the password reset endpoint in Flask-AppBuilder configuration
In your Flask-AppBuilder configuration, set: FAB_ADD_SECURITY_VIEWS = False
Or modify the security manager to exclude reset routes
🧯 If You Can't Patch
- Implement web server/proxy rules to block access to /resetmypassword and similar reset endpoints
- Monitor authentication logs for password reset attempts from disabled user accounts
🔍 How to Verify
Check if Vulnerable:
Check if using Flask-AppBuilder <4.8.1 with OAuth/LDAP authentication and test if /resetmypassword endpoint is accessibleCheck Version:
pip show Flask-AppBuilder | grep VersionVerify Fix Applied:
After upgrading to 4.8.1+, verify password reset endpoint returns 404 or proper error for disabled users📡 Detection & Monitoring
Log Indicators:
- Password reset attempts from disabled user accounts
- JWT token generation for recently disabled users
Network Indicators:
- HTTP POST requests to /resetmypassword endpoint
- Unusual authentication patterns from previously inactive accounts
SIEM Query:
source="web_logs" AND (url_path="/resetmypassword" OR action="password_reset") AND user_status="disabled"