{"id":"CVE-2021-23385","aliases":["DEBIAN-CVE-2021-23385","DLA-3545-1","EUVD-2022-7078","GHSA-cg8c-gc2j-2wf7","MGASA-2023-0105","PYSEC-2026-809","SUSE-SU-2022:3834-1","SUSE-SU-2022:3867-1","UBUNTU-CVE-2021-23385","USN-6792-1","openSUSE-SU-2024:13561-1","openSUSE-SU-2024:14555-1"],"status":"published","title":"Open Redirect","description":"This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\\\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. **Note:** Flask-Security is not maintained anymore.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01247,"percentile":0.69574,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2022-08-02T13:25:14Z","modified":"2026-10-23T18:03:36Z","fixes":[{"ecosystem":"Debian:12","package":"flask-security","fixed_in":["5.0.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"flask-security","fixed_in":["5.0.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"flask-security","fixed_in":["5.0.2-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"flask-security","fixed_in":["1.7.5-2+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"python-flask-security","fixed_in":["3.0.0-1.1.mga8"],"sources":["osv"]},{"ecosystem":"PyPI","package":"flask-security","fixed_in":["5.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"python-Flask-Security","fixed_in":["3.0.0-150100.4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"python-Flask-Security","fixed_in":["3.0.0-150100.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"python-Flask-Security-Too","fixed_in":["3.4.2-150200.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"python-Flask-Security-Too","fixed_in":["3.4.2-150200.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"python-Flask-Security-Too","fixed_in":["3.4.2-150200.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"python-Flask-Security-Too","fixed_in":["3.4.2-150200.3.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"flask-security","fixed_in":["1.7.5-2ubuntu0.18.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"flask-security","fixed_in":["1.7.5-2ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"flask-security","fixed_in":["4.0.0-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"flask-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"flask-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"flask-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"flask-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"flask-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-2+deb10u1"}]}],"versions":["1.7.5-2"]},{"source":"osv","ecosystem":"PyPI","package":"flask-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.0"}]}],"versions":["1.2.0","1.2.1","1.2.2","1.2.3","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","3.0.0"]},{"source":"osv","ecosystem":"Mageia:8","package":"python-flask-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-1.1.mga8"}]}]},{"source":"osv","ecosystem":"PyPI","package":"flask-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.1"}]}],"versions":["1.2.0","1.2.1","1.2.2","1.2.3","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","3.0.0"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"python-Flask-Security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150100.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"python-Flask-Security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150100.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"python-Flask-Security-Too","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"python-Flask-Security-Too","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"python-Flask-Security-Too","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"python-Flask-Security-Too","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"flask-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-2ubuntu0.18.04.1~esm1"}]}],"versions":["1.7.5-1","1.7.5-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"flask-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-2ubuntu0.20.04.1"}]}],"versions":["1.7.5-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"flask-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-1ubuntu0.1"}]}],"versions":["4.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"flask-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-2ubuntu0.18.04.1~esm1"}]}],"versions":["1.7.5-1","1.7.5-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"flask-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-2ubuntu0.20.04.1"}]}],"versions":["1.7.5-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"flask-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-1ubuntu0.1"}]}],"versions":["4.0.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Flask-Security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.2-1.1"}]}],"bundled":3}],"products":[{"vendor":"flask-middleware","product":"flask-security"},{"vendor":"flask-security_project","product":"flask-security"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-PYTHON-FLASKSECURITY-1293234","tags":["x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://github.com/mattupstate/flask-security","tags":["x_transferred","Product","Third Party Advisory","package","report"]},{"url":"https://snyk.io/blog/url-confusion-vulnerabilities/","tags":["x_transferred","Technical Description","Third Party Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00034.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23385","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cg8c-gc2j-2wf7","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-23385","tags":["advisory"]},{"url":"https://snyk.io/blog/url-confusion-vulnerabilities","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2023-0105.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31069","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-November/012786.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RQJQLV6QJLKHFTPTOHMNIPI43YRAGCIO/","tags":["web"]},{"url":"https://pypi.org/project/flask-security","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223834-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1202105","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23385","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223867-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-23385","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23385","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6792-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49438","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-23385","title":"Open Redirect","description":"This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\\\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. **Note:** Flask-Security is not maintained anymore.","status":"published","published":"2022-08-02T13:25:14.717Z","modified":"2024-09-16T22:08:36.808Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2022-7078","description":"This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\\\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. **Note:** Flask-Security is not maintained anymore.","status":"published","published":"2022-08-02T13:25:14Z","modified":"2024-09-16T22:08:36Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C","level":"medium"}],"updated_at":"2026-11-03T00:55:05.688542Z"}],"ghsa":[{"id":"GHSA-cg8c-gc2j-2wf7","title":"Flask-Security vulnerable to Open Redirect","description":"This affects all versions of package Flask-Security. When using the `get_post_logout_redirect` and `get_post_login_redirect` functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as `\\\\\\evil.com/path`. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using `'autocorrect_location_header=False`.\n\n**Note:** Flask-Security is not maintained anymore.","status":"published","published":"2022-10-07T07:29:01Z","modified":"2023-01-29T05:00:51Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:36:25.064927Z"}],"nvd":[{"id":"CVE-2021-23385","description":"This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\\\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. **Note:** Flask-Security is not maintained anymore.","status":"published","published":"2022-08-02T14:15:10.017Z","modified":"2026-06-17T03:38:39.95Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:07:06.906968Z"}],"osv":[{"id":"CVE-2021-23385","description":"This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\\\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. **Note:** Flask-Security is not maintained anymore.","status":"published","published":"2022-08-02T14:15:10.017Z","modified":"2026-07-07T11:56:49.533724357Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"DEBIAN-CVE-2021-23385","description":"This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\\\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. **Note:** Flask-Security is not maintained anymore.","status":"published","published":"2022-08-02T14:15:10.017Z","modified":"2026-10-23T18:03:36.752185012Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-cg8c-gc2j-2wf7","title":"Flask-Security vulnerable to Open Redirect","description":"This affects all versions of package Flask-Security. When using the `get_post_logout_redirect` and `get_post_login_redirect` functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as `\\\\\\evil.com/path`. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using `'autocorrect_location_header=False`.\n\n**Note:** Flask-Security is not maintained anymore.","status":"published","published":"2022-10-07T07:29:01Z","modified":"2026-07-07T11:56:49.533724357Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"PYSEC-2026-809","title":"Flask-Security vulnerable to Open Redirect","description":"This affects all versions of package Flask-Security. When using the `get_post_logout_redirect` and `get_post_login_redirect` functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as `\\\\\\evil.com/path`. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using `'autocorrect_location_header=False`.\n\n**Note:** Flask-Security is not maintained anymore.","status":"published","published":"2026-07-07T10:17:22.496909Z","modified":"2026-07-07T11:45:45.877626931Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"UBUNTU-CVE-2021-23385","description":"This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\\\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. **Note:** Flask-Security is not maintained anymore.","status":"published","published":"2022-08-02T14:15:00Z","modified":"2026-02-04T02:47:59.426501Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"DLA-3545-1","title":"flask-security - security update","status":"published","published":"2023-08-28T00:00:00Z","modified":"2026-03-09T01:18:25.872027Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2023-0105","title":"Updated python-flask-security packages fix security vulnerability","description":"Open redirect (CVE-2021-23385)\n","status":"published","published":"2023-03-24T05:55:49Z","modified":"2026-04-16T04:42:50.436968243Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:13561-1","title":"python310-Flask-Security-Too-5.3.2-3.1 on GA media","description":"These are all security issues fixed in the python310-Flask-Security-Too-5.3.2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:52:13.02334Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:14555-1","title":"python310-Flask-Security-5.5.2-1.1 on GA media","description":"These are all security issues fixed in the python310-Flask-Security-5.5.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-06T00:00:00Z","modified":"2026-02-04T04:31:47.3458Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2022:3834-1","title":"Security update for python-Flask-Security","description":"This update for python-Flask-Security fixes the following issues:\n\n- CVE-2021-23385: Fixed open redirect (bsc#1202105).\n","status":"published","published":"2022-11-01T07:59:00Z","modified":"2026-02-04T03:02:29.765131Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3867-1","title":"Security update for python-Flask-Security-Too","description":"This update for python-Flask-Security-Too fixes the following issues:\n\n- CVE-2021-23385: Fixed open redirect (bsc#1202105).\n\n","status":"published","published":"2022-11-03T14:54:59Z","modified":"2026-02-04T03:18:31.884153Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"USN-6792-1","title":"flask-security vulnerability","description":"Naom Moshe discovered that Flask-Security incorrectly validated URLs. An attacker could use this issue to redirect users to arbitrary URLs.\n","status":"published","published":"2024-05-28T16:08:11Z","modified":"2026-02-10T04:43:49Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}