Threats tagged 'ghsa-j2pw-vp55-fqqj'

Flask-AppBuilder versions prior to 4.3.11 using the deprecated OpenID 2.0 authentication protocol (AUTH_TYPE AUTH_OID) are vulnerable to incorrect authentication. An attacker can forge HTTP requests to trick the backend into accepting any OpenID service, potentially gaining unauthorized privileged access if a malicious OpenID provider is accessible. This vulnerability is critical and has a CVSS score of 9.1. The issue is fixed in version 4.3.11. A workaround is available for those unable to upgrade immediately.