Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
dpgaspar/flask-appbuilder
master @ 69e3e69
88
Fixes
14
CVEs
CRITICAL
Peak severity
47.4%
Coverage
Highlights
Auth Bypass: 42 prior fixes. Scrutinize any change in this area.
flask_appbuilder/security/manager.py: most-fixed (30 issues). Treat as high-risk during review.
45 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Flaws in Azure AD JWT token processing skipped cryptographic signature verification entirely, and failed Okta OAuth responses containing error states were incorrectly processed as successful login sessions. Additionally, standard session loading failed to verify if a loaded user identity remained active.
Authentication Bypass: A critical flaw in the REMOTE_USER authentication backend relied on a malformed SQL filter condition that always evaluated to true, letting unauthenticated actors log in automatically as the administrator.
Auth Bypass: Critical privilege escalation and account takeover existed in the password-reset and profile editing endpoints because the application retrieved the target user identity from user-supplied request parameters rather than securely binding to the session's active g.user context.