CVE-2021-23385
Open Redirect
This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. Note: Flask-Security is not maintained anymore.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Open Redirect
This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. Note: Flask-Security is not maintained anymore.
- Record
CVE-2021-23385- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C - Updated
- 2026-11-02
EUVDEUVD-2022-7078
This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. Note: Flask-Security is not maintained anymore.
- Record
EUVD-2022-7078- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cg8c-gc2j-2wf7
Flask-Security vulnerable to Open Redirect
This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.
Note: Flask-Security is not maintained anymore.
- Record
GHSA-cg8c-gc2j-2wf7- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. Note: Flask-Security is not maintained anymore.
- Record
CVE-2021-23385- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. Note: Flask-Security is not maintained anymore.
- Record
CVE-2021-23385- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-23385
This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. Note: Flask-Security is not maintained anymore.
- Record
DEBIAN-CVE-2021-23385- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 9 moreShow less
OSVGHSA-cg8c-gc2j-2wf7
Flask-Security vulnerable to Open Redirect
This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.
Note: Flask-Security is not maintained anymore.
- Record
GHSA-cg8c-gc2j-2wf7- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVPYSEC-2026-809
Flask-Security vulnerable to Open Redirect
This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.
Note: Flask-Security is not maintained anymore.
- Record
PYSEC-2026-809- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-23385
This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. Note: Flask-Security is not maintained anymore.
- Record
UBUNTU-CVE-2021-23385- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVMGASA-2023-0105 No score
Updated python-flask-security packages fix security vulnerability
Open redirect (CVE-2021-23385)
- Record
MGASA-2023-0105- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13561-1 No score
python310-Flask-Security-Too-5.3.2-3.1 on GA media
These are all security issues fixed in the python310-Flask-Security-Too-5.3.2-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13561-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14555-1 No score
python310-Flask-Security-5.5.2-1.1 on GA media
These are all security issues fixed in the python310-Flask-Security-5.5.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14555-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:3834-1 No score
Security update for python-Flask-Security
This update for python-Flask-Security fixes the following issues:
- CVE-2021-23385: Fixed open redirect (bsc#1202105).
- Record
SUSE-SU-2022:3834-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:3867-1 No score
Security update for python-Flask-Security-Too
This update for python-Flask-Security-Too fixes the following issues:
- CVE-2021-23385: Fixed open redirect (bsc#1202105).
- Record
SUSE-SU-2022:3867-1- Updated
- 2026-11-02
OSVUSN-6792-1 No score
flask-security vulnerability
Naom Moshe discovered that Flask-Security incorrectly validated URLs. An attacker could use this issue to redirect users to arbitrary URLs.
- Record
USN-6792-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flask-securityPyPI |
through 3.0.0 | None known |
flask-securityDebian:12 |
before 5.0.2-1 | 5.0.2-1 |
flask-securityDebian:13 |
before 5.0.2-1 | 5.0.2-1 |
flask-securityDebian:14 |
before 5.0.2-1 | 5.0.2-1 |
flask-securityDebian:10 |
before 1.7.5-2+deb10u1, plus listed versions 1.7.5-2 |
1.7.5-2+deb10u1 |
flask-securityPyPI |
through 3.0.0, plus listed versions 1.2.01.2.11.2.21.2.31.5.0 Show 20 moreShow less1.5.11.5.21.5.31.5.41.6.01.6.11.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.91.7.01.7.11.7.21.7.31.7.41.7.5 |
None known |
python-flask-securityMageia:8 |
before 3.0.0-1.1.mga8 | 3.0.0-1.1.mga8 |
flask-securityPyPI |
before 5.5.1, plus listed versions 1.2.01.2.11.2.21.2.31.5.0 Show 21 moreShow less1.5.11.5.21.5.31.5.41.6.01.6.11.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.91.7.01.7.11.7.21.7.31.7.41.7.53.0.0 |
5.5.1 |
python-Flask-SecurityopenSUSE:Leap 15.3 |
before 3.0.0-150100.4.3.1 | 3.0.0-150100.4.3.1 |
python-Flask-SecurityopenSUSE:Leap 15.4 |
before 3.0.0-150100.4.3.1 | 3.0.0-150100.4.3.1 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-Flask-Security-TooSUSE:Linux Enterprise Module for Basesystem 15 SP3 |
before 3.4.2-150200.3.6.1 | 3.4.2-150200.3.6.1 |
python-Flask-Security-TooSUSE:Linux Enterprise Module for Basesystem 15 SP4 |
before 3.4.2-150200.3.6.1 | 3.4.2-150200.3.6.1 |
python-Flask-Security-TooopenSUSE:Leap 15.3 |
before 3.4.2-150200.3.6.1 | 3.4.2-150200.3.6.1 |
python-Flask-Security-TooopenSUSE:Leap 15.4 |
before 3.4.2-150200.3.6.1 | 3.4.2-150200.3.6.1 |
flask-securityUbuntu:Pro:18.04:LTS |
before 1.7.5-2ubuntu0.18.04.1~esm1, plus listed versions 1.7.5-11.7.5-2 |
1.7.5-2ubuntu0.18.04.1~esm1 |
flask-securityUbuntu:20.04:LTS |
before 1.7.5-2ubuntu0.20.04.1, plus listed versions 1.7.5-2 |
1.7.5-2ubuntu0.20.04.1 |
flask-securityUbuntu:22.04:LTS |
before 4.0.0-1ubuntu0.1, plus listed versions 4.0.0-1 |
4.0.0-1ubuntu0.1 |
python-Flask-SecurityopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 5.5.2-1.1 | 5.5.2-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-23385 is a medium vulnerability (CVSS 5.4) in Flask-middleware Flask-security, published August 2, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile. Fixed in flask-security 5.0.2-1.
References
security.snyk.io/vuln/SNYK-PYTHON-FLASKSECURITY-1293234
github.com/mattupstate/flask-security
snyk.io/blog/url-confusion-vulnerabilities
lists.debian.org/debian-lts-announce/2023/08/msg00034.html
nvd.nist.gov/vuln/detail/CVE-2021-23385
Show 15 moreShow less
security-tracker.debian.org/tracker/CVE-2021-23385
advisories.mageia.org/MGASA-2023-0105.html
bugs.mageia.org/show_bug.cgi?id=31069
lists.suse.com/pipermail/sle-security-updates/2022-November/012786.html
lists.opensuse.org/archives/list/[email protected]/thread/RQJQLV6QJLKHFTPTOHMNIPI43YRAGCIO
pypi.org/project/flask-security
suse.com/support/update/announcement/2022/suse-su-20223834-1
bugzilla.suse.com/1202105
ubuntu.com/security/CVE-2021-23385
cve.org/CVERecord?id=CVE-2021-23385