Listen to this Post
The CVE-2025-45620 vulnerability exists because the password reset endpoint is not properly disabled when Flask-AppBuilder is configured to use non-database authentication methods like OAuth or LDAP. Although the UI hides the reset link, the underlying `/resetmypassword` route remains active. An attacker with a valid, but disabled, user account can exploit this by submitting a password reset request. Upon resetting their password, the application creates a local user account tied to the disabled external identity. This local account is then used to generate valid JWT tokens, effectively bypassing the disabled status enforced by the primary authentication provider and granting unauthorized access.
Platform: Flask-AppBuilder
Version: <4.8.1
Vulnerability: Auth Bypass
Severity: Moderate
date: 2025-09-11
Prediction: Patch: 2025-09-11
What Undercode Say:
`curl -X POST http://
`fabmanager reset-password –username disabled_user`
How Exploit:
Access `/resetmypassword` endpoint. Submit reset for a known, disabled username. Set new password. Use new credentials for JWT token generation and API access.
Protection from this CVE:
Upgrade to v4.8.1. Manually remove reset route if upgrade is impossible.
Impact:
Disabled users can regain access. Bypasses external auth provider controls.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
