/Vulnerability Library

Python Flask-Security-Too <=5.3.2 - Open Redirect

CVE-2023-49438
Verified

Description

An open redirect vulnerability exists in the python package Flask-Security-Too prior to version 5.3.3. Attackers can abuse the 'next' parameter on the /login and /register routes to redirect unsuspecting users to malicious sites via crafted URLs, which could lead to phishing or other attacks ([NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-49438)).

Severity

Medium

CVSS Score

6.1

Exploit Probability

1%

Affected Product

flask-security-too

Published Date

April 21, 2026

Template Author

ritikchaddha

CVE-2023-49438.yaml
6.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE ID:
cve-2023-49438
CWE ID:
cwe-601

References

https://github.com/Flask-Middleware/flask-securityhttps://github.com/brandon-t-elliott/CVE-2023-49438https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HCYH377TPUMUHELPI36PDS2ZM4VFIXM/https://nvd.nist.gov/vuln/detail/CVE-2023-49438

Remediation Steps

Upgrade Flask-Security-Too to version 5.3.3 or later to mitigate the open redirect vulnerability.