Open Redirect Affecting flask-security package, versions [,5.8.1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-FLASKSECURITY-17670533
- published29 Jun 2026
- disclosed23 Jun 2026
- creditUnknown
Introduced: 23 Jun 2026
New CVE NOT AVAILABLE CWE-601 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade Flask-Security to version 5.8.1 or higher.
Overview
Flask-Security is a Simple security for Flask apps.
Affected versions of this package are vulnerable to Open Redirect via the validate_redirect_url function. An attacker can redirect users to an attacker-controlled domain by crafting a specially formatted URL containing a backslash in the authority component, which bypasses subdomain validation. This is only exploitable if subdomain redirects are enabled in the configuration.